Cb Defense Sensor: Performance Issue Due to DB Corruption

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Machine becomes unusable, with high I/O and CPU utilization observed for CB Defense processes
• Confer.log shows repeated DbReadFileDb and DbGetRepSrcTable errors:

b00 DbReadFileDb: error executing SQL command: 11
b00 DbGetRepSrcTable: error executing SQL command (11)

Environment

• Cb Defense Sensor: 3.1.x - 3.3.x
• Microsoft Windows: All Supported Versions

Cause

• DB corruption can occur when a machine/Sensor crashes or during power losses or hard resets
• This condition can persist through a Sensor upgrade

Resolution

Recommended procedure is to uninstall Sensor completely and re-install

Additional Information

This issue is fixed in the 3.4 sensor release via DSEN-2877