CB Response: Windows Sensor cb.exe process growing up to several GB RAM in size

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The cb.exe process grows to several GB in memory usage

Environment

• CB Response Sensor: 6.1.2 - 6.1.6
• Microsoft Windows: All supported versions

Cause

This is a known issue - CB-19764

Resolution

• Upgrade to sensor version 6.1.7 or greater
• If unable to upgrade, a temporary workaround is to restart the sensor every 12 hours to lower memory usage 

1. sc stop carbonblack
   

2. sc start carbonblack

Additional Information

Endpoints experiencing this issue will have a high map_scan_id_to_md5_ entry in C:\windows\CarbonBlack\Diagnostics\EventConverter.log. Anything over 1,000,000 is a good indicator of this issue.