Troubleshooting Agent Performance Issues

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Step-by-step guidance on troubleshooting Agent performance issues.

Environment

• App Control Console: All Versions
• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions
• Apple MacOS: All Supported Versions
• Linux: All Supported Versions

Resolution

1. Verify the impacted machine is:
   • using a supported and compatible Agent version.
   • able to recreate the issue with the latest Agent version.
2. If using Windows Agent 8.9.x, apply the two Agent Configs as outlined here.
3. Verify the Agent Exclusions are present in any installed third-party security applications (e.g. antivirus, firewall, real-time scanner, vulnerability scanner, etc.).
4. Verify the Agent is fully Initialized, as the Initialization process itself can be resource intensive.
5. Check for Custom Rules that should be avoided due to negative impacts on Agent performance.
6. Verify whether any available Rapid Configs would apply in Rules > Software Rules > Rapid Configs and enable accordingly. Some examples include:
   • Linux System Performance
   • Microsoft Exchange Server
   • Microsoft SQL Server
   • Visual Studio
7. If troubleshooting a Windows performance issue:
   1. Verify configs for Windows Updates that take a long time to install.
   2. Review guidance when Agent is scanning large files (.vmdk, .vhd, .bak, etc)
   3. Use Procmon to identify processes that could be included in a Performance Optimization Rule.
8. If troubleshooting a Linux performance issue:
   1. Verify the Agent's db-wal growth is not negatively impacting performance.
   2. Verify the Linux System Performance Rapid Config is properly configured and applied.
9. Verify the Agent's CL Version is up-to-date to ensure any/all changes are applied to the Agent.

If the issue persists, collect the Agent Performance Logs and open a case with the Support.

Additional Information

• A Performance Optimization Rule will ignore all file operations on the Path or File by the specified Process, except file executions.
• Whenever possible, Agent Performance Logs should be collected from the latest available Agent version while still able to replicate the issue.