Recurring CPU and IO Spike Every 5 Hours - CheckSystemCatalogUpdate

Products

• Carbon Black App Control

Issue/Introduction

• Every 5 hours there is a small CPU and/or disk IO spike
• Trace.bt9 shows the "CheckSystemCatalogUpdate" task start, followed by files having a ReCheckSignature task:

  Worker::operator (): Processing WorkItem[CheckSystemCatalogUpdate]
  Worker::operator (): Check for catalog update and re-evaluate system files with no signature
  ...
  ReCheckSignature File[\\?\globalroot\device\harddiskvolume5\<FileName>] Count[00000002]

Environment

• App Control: Agent Version 8.10+
• Microsoft Windows: All Supported Versions

Cause

CheckSystemCatalogUpdate is a scheduled task that runs every 5 hours. It rechecks the signature of files that were previously reported to be unsigned.

Resolution

For environments sensitive to these IO fluctuations, create a 'Technical' Support Case for assistance tuning this function.