EDR: Slow system performance when executing df

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

When executing commands to check the status of disk and mount points, the command takes several seconds to return information.

Environment

• EDR Server: All Versions
• Hosted EDR Server: All Versions

Cause

A possible cause is an issue with an NFS mount point added by a customer. This is not related to an issue with EDR Server.

Resolution

Contact your Linux System Administrators to determine why the mount points are causing performance issues.

Additional Information

SOLR does similar querying of disk usage during normal operation. If commands like df take extended amount of time to run, the calls SOLR makes will also add latency. This will have a cascading negative effect on CB Response services.