EDR Sensor: Increased disk reads to PVS drive during sign in on Citrix non-persistent VDI
book
Article ID: 289884
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
With the EDR sensor installed, Bytes Read to PVS drive increases by several hundred megabytes
Environment
- EDR Sensor: All Supported Versions
- Microsoft Windows: All Supported Versions
- Citrix non-presistent VDI
Cause
In order to track events, the sensor must perform a hash against any processes during login.
Resolution
The product is behaving as designed
Additional Information
- The amount of reads will depend on the number of services that start during login
- Reports may show large disk reads, but internal investigation of actual network impact should be investigated internally to determine true impact
- Collection of specific events can be stopped in the sensor group settings, but will result in a lost of visibility
Feedback
thumb_up
Yes
thumb_down
No