App Control: Long Delays When Saving Files on a Network Share

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Slower than average writes to network shared drives. 
• Longer times saving and opening Microsoft Office documents. 

Environment

• App Control Agent: All Versions
• Microsoft Windows: All Supported Versions

Cause

This issue is caused by a normalization attempt by the App Control Agent, attempting to find if the path is a DFS share. 

Resolution

1. Open the App Control console. 
2. Navigate to Assets > Computers and select the device having the issue. 
3. In the URL save the Host_ID listed. 
4. Change the URL to https://<SERVERNAME>/Agent_config.php
5. Click Add Agent Config and enter in the following details:
   • Property Name: Network Share DFS Check
   • Host ID: Enter the number from step 3. Otherwise 0 will apply to all devices. 
   • Value: kernelUseSimpleDFSCheck=0
   • Status: Enabled
6. Save and wait for the device to become up to date on its CL rules. 

Additional Information

Although very rare, some considerations should be known regarding the changing of these values:

1. When kernelUseSimpleDFSCheck=1 is set:
   • Incorrectly processing a path as DFS will result in an invalid pathname which hurts performance due, as opening non-existent files on the network is costly.  
2. When kernelUseSimpleDFSCheck=0 is set:
   • It is possible to incorrectly identify DFS served file paths. This will cause file normalization to fail and may result in blocks due to the lack of a file hash.