Process and Binary search not loading with THP enabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Inconsistent behavior with loading Binary and Process Search.
• Binary pages may not load the first time, but load every time after.

Environment

• EDR Server: 6.3.1 and later
• Linux: 7.6 and later
• THP (Transparent Hugepage) is enabled

Cause

There is an interoperability issue between EDR and THP (Transparent Hugepage) if enabled.

Resolution

Redhat's recommendation for disabling THP:

Check if THP is enabled:

cat /sys/kernel/mm/transparent_hugepage/enabled

Disable at boot time.  Append to the kernel command line in grub.conf

transparent_hugepage=never

Additional Information

From Redhat: 

"The THP feature has two modes of operation: system-wide and per-process. When THP is enabled system-wide, the kernel tries to assign huge pages to any process when it is possible to allocate huge pages and the process is using a large contiguous virtual memory area. If THP is enabled per-process, the kernel only assigns huge pages to individual processes' memory areas specified with the madvise() system call.

Note that the THP feature only supports 2-MB pages. Transparent huge pages are enabled by default."

 

Configuring Transparent Huge Pages