App Control: Widespread Cache Corruption with Agent Database Integrity Check Not Set

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Widespread or re-occurring Agent Cache corruption

Environment

• App Control Server (Formerly CB Protection Server): All Versions
• App Control Agent (Formerly CB Protection Agent): All Versions

Cause

By default, the App Control Agent is set to "Performance" mode, which focuses on Agent performance. In times of system instability/crashes, or with frequent hard stops of the Agent, with the Agent focused on performance it is possible for the cache to become corrupted.

Resolution

Changing the Agent to 'Integrity' mode allows the Agent to focus on maintaining it's files and cache, to prevent the chance of cache corruption.

To put the Agents into the Database Integrity mode:

1. Browse to https://ServerName/agent_config.php.
2. Click on + Add Agent Config
3. Fill in the properties like below:
   • Property Name: Database Integrity Check (Or a name of your choosing)
   • Host ID: Use a specific Host ID to test on one device,or 0 for the entire environment
   • Value: cache_access=2  (confirm there are no spaces before or after)
   • Status: Enabled
4. Save and test

Additional Information

• This lowers the chance of cache corruption, however it will impact performance as the agent is geared towards reducing the chances of corruption and less on performance. You may also receive unexpected blocks, especially if the application is running from a network drive. Prior to deploying the property broadly it should be tested on several machines representative of the environment.
• Do NOT make any additional change on the agent_config.php page as it may cause unexpected behavior or potentially break the installation.