App Control: Agent Consumes High CPU with 'dtex' Application Installed

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Top command consistently reports high CPU usage with b9daemon process, at times as high as 80% usage. 

Environment

• App Control Agent: All Versions
• DTEX Intercept application: All Versions
• Linux: All Supported Versions

Cause

App Control Agent is tracking file operations being performed by DTEX processes.

Resolution

Add 'kernelProcessExclusions' parameter for Agent(s) per following steps:

1. Open following URL -> https://<app_control_ servername>/agent_config.php
2. Select 'Add Agent Config'
3. Add following information, then select Save:

a. Property Name: kernelProcessExclusions for dtex

b. Value: kernelProcessExclusions=/opt/dtex/*:4192127

c. Host Id: 0

d. Platform: Linux

e. Status: Enabled

f. Create For: All Current and Future Policies (Note: If needed, 'Selected policies' can also be used)

Additional Information

• The '4192127' value will ignore all file operations except Execute and ScriptExecute.
• The value of '2094975' should be used for Agents on v7.2.2 and below
• Enter host_id of Agent to test on specific machine