App Control: Agents reporting events with an older CL version

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why are agents reporting events with an old CL version in the console?

Environment

App Control Console: All Supported Versions

Resolution

The CL version is included in the event when it gets send from the agents to the console.
Therefore, if the CL version of an agent is restored to an older CL version then the agent will report events starting with this old CL until it gets caught up with the most recent CL version.

Additional Information

In environments with a very large CL version, it may take some time for an agent to get caught up with the most recent CL.

Possible reasons why the CL version of an agent can go back to an older version:

• Cache corruption
• System is re-imaged with an older agent
• New agent install using an outdate Policy MSI installer
• Resend of All Policies to the agent was triggered from the console