Performance Issues With VMs and Other Large Files on Agent 8.8 or Higher

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• High resource usage or performance degradation due to parity.exe reading large files.
• May experience Windows "File In Use" messages, similar to:

  The action can't be completed because the file is open in Carbon Black App Control Agent

Environment

• App Control Agent: 8.8.0 and Higher
• App Control Console: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

As of the 8.8.0 Agent, Yara scans now occur on large files. Performance issues may be encountered on large files (such as vmdk, vhd, etc) during this analysis.

Resolution

In many situations these files never execute, and a Performance Optimization Rule would be the most efficient way to handle this.

 

If the files are executable, or if the issue persists: collect the Agent Performance Logs and open a case with Support.