Background scan process (LocalScanner) on Linux endpoints generating operations against NFS mounts

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

File activity observed coming from cbagentd LocalScanner process against file mount types that should be excluded

Environment

• Carbon Black Cloud Console: All Versions
• Carbon Black Cloud Sensor: All Versions
• Linux: All Supported Versions

Cause

CRE-22193, issue with Linux sensor enumerating NFS

Resolution

• Behavior can be temporarily stopped by Pausing a Background Scan
• Background scan will resume on endpoint/sensor restart, or any policy change, so this may need to be repeated
• CRE-22193 will be fixed in a future product release.