App Control: After Rules Installer Upload the Console Stops Functioning and the Server Service Keeps Stopping

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Rules installer package was added to the server resulting in the console not available
• Network error while trying to communicate with App Control error message
• The server service keeps stopping repeatedly and wont stay started
• Server Log errors seen:

[5] 18:37:16 (4236 Main) Statement returned error [8152]: [Microsoft][SQL Server Native Client 11.0][SQL Server]String or binary data would be truncated.
[6] 18:37:16 (4236 Main) Exception in RulesStorage::CreateDefaultRules (8152): [Microsoft][SQL Server Native Client 11.0][SQL Server]String or binary data would be truncated..
[7] 18:37:19 (4236 Main) Failed to create initial rules.
[8] 18:37:19 (4236 Main) Shutting down the server.

or error:

[5] 15:57:02 (4460 Main) Creation of initial Updaters failed : String or binary data would be truncated. Updater: <Updater name="Windows App Store"...
[6] 15:57:03 (4460 Main) Failed to create initial Updaters.
[7] 15:57:03 (4460 Main) Shutting down the server.

Environment

• App Control Server: All Versions 

Cause

• Some default rules (e.g. Rapid Configs, Updaters) have been modified so that too many path or process patterns have been added
• There is a database size limit for each default rule which is currently 2048 characters
• When the new Rules package is installed, all default rules are recreated during the server service startup which then fails because the 2048 bytes limit has been exceeded

Resolution

1. Open SQL Management
2. Run the following query to check the size of the path and process patterns within the default rules:

   USE das
   ;WITH cte AS
   (
   SELECT len(pattern) as PathSize, len(procname) as ProcessSize,rule_id,name,pattern,procname from dbo.rules
   )
   SELECT * from cte where cte.PathSize > 1900 or cte.ProcessSize > 1900
   

3. If results are returned then these rules likely exceeded the DB size limit
4. Open a Support Ticket and share the results, Support Team will share the next steps

Additional Information

• Make a full database backup since changes to the Das DB will be needed
• This is tracked as EP-12465