Why does the "Sensor Queued History" graph only have recent data?
search cancel

Why does the "Sensor Queued History" graph only have recent data?

book

Article ID: 290922

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why does the "Sensor Queued History" graph in the Sensor Details page only have recent data?

Environment

  • EDR Server: 7.5.0 and Higher

Resolution

  • In previous (7.4.2 and lower) EDR server versions, the "Sensor Queued History" info was implemented as a StoredObject in a postgres table and that this data was purged after 12 hours in an earlier attempt to increase UI responsiveness and sensor checking performance.
  • With 7.5.0 and higher EDR server, they converted the SensorBacklogCache implementation to be a CachedObject instead of a StoredObject, and then some more perf improvements were introduced, but this work results in the table only showing data from the last sensor checkin.