Faceting Causes Slowness on Process Search Page

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• The process search page is loading slowly.
• Disabling facets on process search page improves the performance dramatically. 

Environment

• EDR Server: All Supported Versions

Cause

Faceting might impact the performance of the process search page.

Resolution

To keep facets, if general CPU usage is moderate, threads can be added to the process of faceting.

Steps:
1. On EDR server/primary, modify /etc/cb/cb.conf.
2. Set CoreServicesMaxFacetThreads=1.
3. Save and restart cb-enterprise services / restart cluster.

Additional Information

• By default, CoreServicesMaxFacetThreads is set to none, which means "don't use threads".
• If setting it to any number than none, new threads will be started to do the faceting, which makes it faster. However, this could take resource from process searching.
• Don't try a higher number without appropriate testing.