High CPU Usage When AUTH Events is Enabled
Article ID: 385690
Updated On:
Products
Carbon Black Cloud Managed Detection and Response
Carbon Black Cloud Enterprise EDR
Carbon Black Cloud Endpoint Standard
Issue/Introduction
Sensor is exhibiting high CPU usage when AUTH events is enabled
Environment
Carbon Black Cloud Windows Sensor: All Supported Versions
Cause
An increased amount of AUTH events is causing more work for the sensor to compute
Resolution
- Upgrade to the 4.0.2 sensor as there is an issue fixed with Unique Login Sessions and AUTH events
- Disable AUTH events in the policy
Additional Information
If this only happens when AUTH events and Windows Defender is enabled reach out to Carbon Black for further steps
Feedback
Yes
No
Powered by
