EDR: Linux 6.1.7 sensor experiencing high CPU and Memory issue

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Linux endpoints CPU and Memory usage are higher than expected

Environment

• EDR Server 6.x and Higher
• EDR Sensor: 6.1.7
• Linux: All Supported Versions

Cause

• There are 2 known defects with the Linux 6.1.7 Cb Response sensor that have been fixed in the 6.1.8 Cb Response Sensor
  • CB-16064
  • CB-18105

Resolution

Upgrade to the latest EDR sensor version

Additional Information

• Memory usage in the cbdaemon may increase due to the activity of some long-lived processes. A workaround is to restart the long-lived process or cbdaemon. [CB-16064] 
• Some of the tracking data in the kernel is using more memory than expected. This is most noticeable on systems with many long-lived processes. [CB-18105]