EDR: Host Uptime is Incorrect

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

The host uptime on the sensor page is incorrect.

Environment

• EDR server: All versions
• EDR sensor: All versions

Cause

Issues on OS or VM host.

Resolution

Response sensor pulls uptime from OS API. Please check if there is a bug of uptime on your OS version, or if there is a bug of uptime on the VM host.

Here are some possible bugs:
https://answers.microsoft.com/en-us/windows/forum/windows_8-performance/up-time-in-the-task-manager-is-incorrect/f21688ab-8991-4f51-8261-2ed23ecf5e3e
https://communities.vmware.com/thread/551861 
https://blog.ganser.com/wrong-uptime-on-guests-running-windows-2008-2008-r2-7-8/ 
https://kb.vmware.com/s/article/2082042