Receiving "Database timeout expired" error in Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Searching for specific files, or filtering for different criteria results in a "Database timeout expired" error in Console. 
• Example message from PHPErrors.log file:

  API Error from page 502: GET parity.server.com/api/bit9platform/restricted/fileInstanceAll/ with params {"sort":"id DESC","q":["fileName:msiexec.exe"],"expand":["computerId","fileInstanceGroupId","fileInstanceId","fileCatalogId"],"offset":"0","limit":76} with options {"81":0,"64":0,"19913":1,"42":0,"156":61000,"10023":"[removed from logging]","10022":"[removed from logging]","10015":"[removed from logging]"} returned http code 408 and result in 60.685168027878 seconds
  

Environment

• App Control Console: All Supported Versions
• Microsoft SQL Server: All Supported Versions

Cause

The SQL Query execution took longer to complete than the timeout allowed by the Console to prevent performance/stability issues with the App Control Server.

Resolution

1. Verify SQL Server meets the Operating Environment Requirements for CPU, Memory and Storage:
   • Tech Docs > Server Documentation > SQL Server Configuration Guide.
2. Determine if the slowness occurs on a specific page or query.
   • The Filter: "contains" is a very taxing query.
   • Consider reducing the timeframe for the query.
   • The more specific and targeted the query, the faster the results will be.
   • Consider utilizing Event Caching for complicated queries
3. Upgrade to the latest Server version to eliminate potentially related defects and take advantage of enhancements, some examples:
   • EP-18900: Improved API query performance for some requests (Server 8.10.2)
   • EP-19460: Changed how we store yara tags associated with file instances  to improve query performance (Server 8.10.2)
4. If the issue persists, increase the timeout:
   1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
   2. Select the property: API_TimeoutS
   3. Increase to 120 and save the change.
   4. Log in to the application server as the Carbon Black Service Account.
   5. Use an administrative command prompt to issue:

      iisreset

Additional Information

• Timeouts will still occur after increasing API_TimeoutS if SQL Server requires more than 2 minutes for the query to complete.
• Avoid setting 'API_TimeoutS' parameter higher than 120 as this could cause severe performance issues with Console.