Linux Agent cache.db Excessively Large and Consuming More Space Than Expected

Products

• Carbon Black App Control

Issue/Introduction

• Linux Agent cache (/srv/bit9/data/cache.db) is much larger than expected (ex: 2GB+)
• In some instances, Health Checks may be generated similar to

  Carbon Black App Control Agent has a database that is XXXX bytes and is larger than the currently configured safe maximum size of 1000000000 bytes.. FailureId[164]

• In some instances, these same Agents could also generate Health Checks referencing FailureId[165]

  Carbon Black App Control Agent has a database that is growing too fast. .... FailureId[165]

Environment

• Linux Agent: 8.8.2 and lower

Cause

A defect in the Agent is preventing pruning of a table during regular database maintenance.

Resolution

This issue was tracked under EPCB-23741 and will be resolved with the release of Linux Agent 8.8.4. In the meantime the only workaround to reclaim the space in this situation is to delete the Agent's cache.

Additional Information

• Currently it is not possible to verify the table size without opening a Support Case and providing the Agent Historical Logs.
• This table growth should not directly impact Agent performance, but could limit available free space on the endpoint.
• Deleting the Agent's cache...
  • Will cause Initialization to take place which may temporarily impact performance.
  • Is a temporary fix, and the cache.db growth could return.