App Control: Blocks on Globally Approved Files Due to "Data is Bad for Configlist" Errors

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Blocks on globally approved files
• Events that match:
  • Subtype "Server Configlist Error"
  • Description: "Data is Bad for Configlist Entry"

Environment

• App Control Server: 8.1.4
• App Control Agent: 8.1.4.x or 8.1.5.x

Cause

This is caused by a race condition involving the cache.db

Resolution

1. Upgrade to the 8.1.6 or higher agent
2. Navigate to https://<Servername>/shepherd_config.php
3. Find property "EnableConfigListFullImport"
4. Set property to "true"
5. Re-send policy rules to the affected devices
   • https://community.carbonblack.com/t5/Knowledge-Base/Cb-Protection-How-to-resend-policy-rules-to-an-agent/ta-p/63241

Additional Information

The terms "configlist" and "config list" are used interchangeably.
https://community.carbonblack.com/t5/Documentation-Downloads/CB-Protection-Windows-Agent-v8-1-6/ta-p/73545
https://community.carbonblack.com/t5/Documentation-Downloads/CB-Protection-8-1-6-Windows-Agent-Release-Notes/ta-p/73783