EDR: High resource utilization on 6.2.3 sensors

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Sensor utilizing a high amount of resources
• Issue is temporarily resolved by restarting the sensor / server
• Sensor logs may show error 0x80072f8f

Environment

• EDR Sensor: 6.2.3
• Microsoft Windows 2012 Standard R2

Cause

Multiple performance bugs including an issue with normalizing file names (CB-28353)

Resolution

Upgrade to sensor version 6.2.5 or higher