App Control: Agent Stopped Scanning Trusted Directory

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

What’s the best way to tell if a Trusted Directory isn’t being scanned properly?

Environment

• App Control (Formerly CB Protection) Server: All Versions

Resolution

1. The progress indicator on the Directories tab on the Software Rules page is not a count of files queued to scan vs. already scanned. It’s a list of crawl jobs queued vs. crawl jobs processed.    
   • A crawl job is a job performed by the agents “crawler” which scans sub-directories and file archives.  The Events page can also be used for Trusted Directory related events. There are event subtypes that show directory creation and modification as well as the results of any file analysis that occurs within the Trusted Directory
2. The Events page can also be used for Trusted Directory related events. There are event subtypes that show directory creation and modification as well as the results of any file analysis that occurs within the Trusted Directory.
   • This is the most straightforward method to use when checking on the Trusted Directories status.