Server Backlog Caused by .NET Activity
book
Article ID: 288406
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Increased Server backlog shows that much of the activity is coming from .NET
Environment
- App Control Agent: All Supported Versions
- App Control Console: All Supported Versions
- Microsoft Windows: All Supported Versions
Cause
.NET is generating a large number of new Files and Events for the Agent to track and report.
Resolution
Instruct the Agents to not to send Events related to .NET back to the Server, but to still scan and track related operations locally.
- Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
- Select the Property ABExclusionRules and change the Value accordingly:
- If a Value exists, copy & paste this to the end:
|;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3
- If a Value doesn't exist, copy & paste this:
;;*\windows\microsoft.net\framework*\csc.exe,*\windows\microsoft.net\framework*\vbc.exe,*\windows\microsoft.net\framework*\mscorsvw.exe;;;;;;;;3
- Click Change to apply the new ABExclusion.
Additional Information
- ABExclusions are separated with the pipe character: |
- Trailing/Proceeding spaces are not supported in ABExclusions.
Feedback
thumb_up
Yes
thumb_down
No