Core Files in /srv/bit9/data Filling Disk Space

Products

• Carbon Black App Control

Issue/Introduction

Disk space is filling up with Core.<number> files in the /srv/bit9/data/ directory

• GDB output shows a similar message: 

  #0  0x000000000065c26c in KernelRuleList::GetRules(std::vector<std::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> >, std::allocator<std::basic_string<wchar_t, std::char_traits<wchar_t>, std::allocator<wchar_t> > > >&) ()

Environment

• Carbon Black Application Control: 8.8.6 and Below
• Linux

Cause

Cache consistency is generating a core dump due to missing rule set. 

Resolution

Fix

Upgrade to 8.9.0 to fix the issue

Workaround for 8.8.6 and Below

Update the cache consistency check to happen less frequently as a temporary workaround. 

1. 1. Log into the Console
   2. Access the agent_config.php page. 

      https://servername/agent_config.php

   3. Add Agent Config
      1. Property Name: Temporary Core Reduction
      2. Host ID: 0
      3. Value: 

         cache_maintenance_timer_interval_seconds=216000

      4. Platform: Linux
      5. Status: Enabled
      6. Create For: All Current and Future Polices

Additional Information

• The configuration is set to all Linux agents. This can be narrowed down. 
  • Host ID set to a specific host id experiencing the issue. 0 is for all. 
  • Select a specific policy that affected agent's reside under. 
• Default is 4500 seconds (75 min). Setting to 216000 will do cache checks every 6 hours, reducing the amount of potential Core files to be generated. 
• If cores are still being generated too often, raise this value again to something higher. 
• The workaround configuration should be disabled after upgrading to 8.9.0 or higher.