File Reputation Synchronization Fails with SQL Execution Timeout Expired

Products

• Carbon Black App Control

Issue/Introduction

The Carbon Black App Control Console reports that File Reputation (CDC) synchronization is unavailable or stuck. The Reporter.log (typically located in C:\Program Files (x86)\Bit9\Reporter\Reporter.log) contains the following error: 

2026-05-11 23:59:28,837 [ 8] ERROR AntibodyMetadataLookup - Cb Threat Intel sync - System.Data.SqlClient.SqlException (0x80131904): Execution Timeout Expired. The timeout period elapsed prior to completion of the operation or the server is not responding. ---> System.ComponentModel.Win32Exception (0x80004005): The wait operation timed out

Environment

• Carbon Black Application Control Server: All Versions

Cause

This issue typically occurs when the antibody_lookup table has grown significantly (often following a period of service disconnection or certificate expiration). When the service attempts to "catch up," the default batch size for metadata lookups is too large for the database to process within the default SQL command timeout window, leading to a recurring timeout exception.

Resolution

To resolve this, adjust the batch size and increase the allowed timeout duration within the server configuration.

1. Log in to the App Control Console.
2. Navigate to the internal configuration page: https://<ServerAddress>/shepherd_config.php.
3. Locate and modify (or add) the following two properties:
   
   • Property: ReporterMetadataLookupCommandTimeoutSec
     • Value: 120 (Increased from the default of 60)
4. Click Change to save the setting
5. On the App Control Server, restart the following services:
   • Carbon Black App Control Reporter
   • Carbon Black App Control Server
6. Monitor the Reporter.log to confirm that the AntibodyMetadataLookup process completes successfully without further timeout errors.
7. If errors continue to occur, adjust the lookup count in the shepherd_config.php page.  
   • Property: ReporterMetadataLookupCount
     • Value: 500 (Reduced from the default of 1000)

Additional Information

• Completion of the sync can take some time to complete. Watch the syncronization percentage to validate an upward trend.