CB Response: Windows Sensor cb.exe process growing up to several GB RAM in size
search cancel

CB Response: Windows Sensor cb.exe process growing up to several GB RAM in size

book

Article ID: 290615

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • The cb.exe process grows to several GB in memory usage

Environment

  • CB Response Sensor: 6.1.2 - 6.1.6
  • Microsoft Windows: All supported versions

Cause

This is a known issue - CB-19764

Resolution

  • Upgrade to sensor version 6.1.7 or greater
  • If unable to upgrade, a temporary workaround is to restart the sensor every 12 hours to lower memory usage 
  1. sc stop carbonblack
    
  2. sc start carbonblack

Additional Information

Endpoints experiencing this issue will have a high map_scan_id_to_md5_ entry in C:\windows\CarbonBlack\Diagnostics\EventConverter.log. Anything over 1,000,000 is a good indicator of this issue.