Why does the "Sensor Queued History" graph only have recent data?
book
Article ID: 290922
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Why does the "Sensor Queued History" graph in the Sensor Details page only have recent data?
Environment
EDR Server: 7.5.0 and Higher
Resolution
In previous (7.4.2 and lower) EDR server versions, the "Sensor Queued History" info was implemented as a StoredObject in a postgres table and that this data was purged after 12 hours in an earlier attempt to increase UI responsiveness and sensor checking performance.
With 7.5.0 and higher EDR server, they converted the SensorBacklogCache implementation to be a CachedObject instead of a StoredObject, and then some more perf improvements were introduced, but this work results in the table only showing data from the last sensor checkin.