App Control: Linux Agent High Memory Usage and Page Allocation Errors

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• High memory utilization
• High memory allocation
• Memory Allocation Errors in messages log

  bit9_malloc: failed to allocate block size

Environment

• App Control Agent: All Versions (formerly CB Protection Agent)
• Linux: All Supported Versions

Cause

The high memory utilization is a factor of a few items

• Very active processes, that the agent is tracking
• Number of rules on the device
• Long Uptime causing large memory blocks to be unavailable

Resolution

While high memory utilization is expected on Linux devices due to their file activity there are some ways to improve performance. VMware Carbon Black is also investigating improvements on performance in future releases.

1. Verify the Linux System Performance (LSP) Rapid Config is enabled
2. Disable, delete or update any rules that do not apply to the Linux policies
3. Create performance optimization rules, for the most active processes and directories
4. Schedule reboots of server at specific intervals to free up large allocated blocks of memory
5. Contact Technical Support for assistance in applying "Kernel Exclusions"

Additional Information

• To confirm LSP Rapid Config is enabled: Open Console-> Rules-> Software Rules-> Rapid Config tab, add search filter: 'Name contains Linux System Performance', then Apply
• If assistance is required in writing performance rules, or to do a full rule review, please reach out to your Customer Success Manager to arrange time with Professional Services. https://community.carbonblack.com/t5/Support-Zone/Guide-to-Carbon-Black-Customer-Support/ta-p/34324#S3