Event Backlog Caused by Session Change Events

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Events are missing in the console or being delayed before showing up in the console
• Only limited number of days of events are available in the console, despite the events retention period that was set
• Large numbers of Events with the Subtype Agent Notification (session change) are being sent to the Console by the Agents similar to:

Session change on 'DOMAIN\COMPUTER': ServiceControl[14:SessionChange] Event[00000005] Type[SessionLogon] SessionId[1] User[DOMAIN\USER].

Environment

• App Control Console: All Supported Versions
• App Control Agent: All Supported Versions

Cause

The Agent will send Session Change Events to help track with user access. In environments with large numbers of Agents, or multiple session changes per day, this can contribute to a significant portion of Events.

Resolution

If this information is not needed, consider adding an AB Exclusion to prevent the Events from being sent back to the Server:

1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
2. Select the Property ABExclusionRules and change the Value accordingly:
   • If a Value exists, copy & paste this to the end:

     |;;;;;;;1018;;;2

   • If a Value doesn't exist, copy & paste this:

     ;;;;;;;1018;;;2

3. Click Change to apply the new ABExclusion.

Additional Information

• ABExclusions are separated with the pipe character: |
• Trailing/Proceeding spaces are not supported in ABExclusions.