EDR: High memory utilization by cbdaemon

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

cbdaemon memory utilization continually grows on linux endpoints.

Environment

• EDR (formerly Cb Response) Linux Sensor: All Versions

Cause

This item is currently being tracked as BUG ID: CB-16064

Resolution

• Improvements to the Cb Sensor will be rolled out throughout versions, an upgrade to the latest available version may resolve the issue. Several memory consumption issues were resolved in Linux sensor version 7.0.3 and higher.
• As a workaround, create a cron job to restart cbdaemon nightly at Midnight.

1. Enter crontab as root:

   • crontab -e
     
     *Enter insert mode with i

2. Paste in this line: 

   • 0 0 * * * service cbdaemon restart

3. Save and quit 

   • :wq

4. Verify the cron job is entered for root: 

   • crontab -l