Sensor Service Failing to Start Due to "paging file is too small" error

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
• Carbon Black Cloud Workload

Issue/Introduction

• Sensor no longer checking in to the console
• Sensor Service (CB Defense) not running and failing to start
• Windows Event Viewer System Logs shows entry similar to:

  Error - MM/DD/YYYY - Timestamp - Service Control Manager - Event ID:7000
  
  The CB Defense service failed to start due to the following error: 
  The paging file is too small for this operation to complete.

Environment

• Carbon Black Cloud Sensor: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

This is caused by resource exhaustion on the device.

Resolution

1. Look for resource exhaustion events in the same System Log:

   Warning - MM/DD/YYYY - Timestamp - Resource-Exhaustion-Detector - Event ID:2004

2. In the resource exhaustion event, it will list what processes are responsible for the memory utilization:

   Windows successfully diagnosed a low virtual memory condition. The following programs consumed the most virtual memory: <ServiceName> (14716) consumed 30509105152 bytes, <ServiceName> (4844) consumed 386240512 bytes, and <ServiceName> (10924) consumed 367706112 bytes.