App Control: Linux Agent High Memory Usage and Page Allocation Errors
book
Article ID: 288796
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
High memory utilization
High memory allocation
Memory Allocation Errors in messages log
bit9_malloc: failed to allocate block size
Environment
App Control Agent: All Versions (formerly CB Protection Agent)
Linux: All Supported Versions
Cause
The high memory utilization is a factor of a few items
Very active processes, that the agent is tracking
Number of rules on the device
Long Uptime causing large memory blocks to be unavailable
Resolution
While high memory utilization is expected on Linux devices due to their file activity there are some ways to improve performance. VMware Carbon Black is also investigating improvements on performance in future releases.
Verify the Linux System Performance (LSP) Rapid Config is enabled
Disable, delete or update any rules that do not apply to the Linux policies
Create performance optimization rules, for the most active processes and directories
Schedule reboots of server at specific intervals to free up large allocated blocks of memory
Contact Technical Support for assistance in applying "Kernel Exclusions"
Additional Information
To confirm LSP Rapid Config is enabled: Open Console-> Rules-> Software Rules-> Rapid Config tab, add search filter: 'Name contains Linux System Performance', then Apply
If assistance is required in writing performance rules, or to do a full rule review, please reach out to your Customer Success Manager to arrange time with Professional Services. https://community.carbonblack.com/t5/Support-Zone/Guide-to-Carbon-Black-Customer-Support/ta-p/34324#S3