Agent Stuck in Initialization

Products

• Carbon Black App Control

Issue/Introduction

Initialization percentage is not increasing after an hour or more

Environment

• App Control Agent: All Versions

Resolution

1. Place the agent into a disabled policy.
2. Check for bad sectors on the disk:
   • Run CHKDSK, reboot the machine, re-run CHKDSK to verify that there are no more errors on the disk.
3. Check if there are drives or folders with a very large amount of uninteresting files (e.g., file server or a database application)
   • Ignore such drives or folders from initialization using steps in this KB.
4. Add the following agent configs to improve the initialization performance:

   • Name: Max_analysis_threads (Number of threads for analyzis, 4 threads x 1 CPU Core, e.g. 4 cores x 4 threads = 16)
     Host ID: (e.g. 1234 Use the Host Id of the agent)
     Value: max_analysis_threads=16
     Platform: Windows
     Status: Enabled
     Create For: Selected or All Policies

   • Name: Max_analysis_backlog (Number of items in backlog before new thread starts)
     Host ID: (e.g. 1234 Use the Host Id of the agent)
     Value: max_analysis_backlog=10
     Platform: Windows
     Status: Enabled
     Create For: Selected or All Policies

   • Name: Analysis_queue_busy_threshold (Maximum number of items in the analysis queue)
     Host ID: (e.g. 1234 Use the Host Id of the agent)
     Value: analysis_queue_busy_threshold=1000
     Platform: Windows
     Status: Enabled
     Create For: Selected or All Policies

   • Name: Initialization_priority (Initialization runs without delay, resulting in high CPU usage)
     Host ID: (e.g. 1234 Use the Host Id of the agent)
     Value: initialization_priority=0
     Platform: Windows
     Status: Enabled
     Create For: Selected or All Policies
     Warning: This config results in faster initialization but will cause a performance impact. Ignore the config to avoid the high CPU.

5. Move the agent back into an enforcement policy to trigger initialization.