CB Response: Windows Sensor cb.exe process growing up to several GB RAM in size
book
Article ID: 290615
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
The cb.exe process grows to several GB in memory usage
Environment
CB Response Sensor: 6.1.2 - 6.1.6
Microsoft Windows: All supported versions
Cause
This is a known issue - CB-19764
Resolution
Upgrade to sensor version 6.1.7 or greater
If unable to upgrade, a temporary workaround is to restart the sensor every 12 hours to lower memory usage
sc stop carbonblack
sc start carbonblack
Additional Information
Endpoints experiencing this issue will have a high map_scan_id_to_md5_ entry in C:\windows\CarbonBlack\Diagnostics\EventConverter.log. Anything over 1,000,000 is a good indicator of this issue.