Receiving "Database timeout expired" error in Console

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Searching for specific files, or filtering for different criteria results in a "Database timeout expired" error in Console. 
• Example message from PHPErrors.log file:

  API Error from page 502: GET parity.server.com/api/bit9platform/restricted/fileInstanceAll/ with params {"sort":"id DESC","q":["fileName:msiexec.exe"],"expand":["computerId","fileInstanceGroupId","fileInstanceId","fileCatalogId"],"offset":"0","limit":76} with options {"81":0,"64":0,"19913":1,"42":0,"156":61000,"10023":"[removed from logging]","10022":"[removed from logging]","10015":"[removed from logging]"} returned http code 408 and result in 60.685168027878 seconds
  

Environment

• App Control Console: All Supported Versions
• Microsoft SQL Server: All Supported Versions

Cause

The query executed by SQL Server took longer to complete than the timeout allowed by the Console to prevent performance/stability issues with the App Control Server.

Resolution

1. Verify the SQL Server meets the Operating Environment Requirements for CPU, Memory and Storage:
   • Review the SQL Server Configuration Guide in Tech Docs > Server Documentation.
   • Verify the SQL Server Disk Performance meets requirements for the environment.
2. Determine if the slowness occurs on a specific page or query.
   • Using the Filter "contains" is very taxing on SQL Queries.
   • Consider reducing the timeframe or the columns returned for the query.
   • The more specific and targeted the query, the faster the results will be.
   • Consider utilizing Event Caching for complicated queries
3. Upgrade to the latest Server version to eliminate potentially related defects and take advantage of enhancements, some examples:
   • EPCB-18900: Improved API query performance for some requests (Server 8.10.2)
   • EPCB-19460: Changed how we store yara tags associated with file instances  to improve query performance (Server 8.10.2)
   • EPCB-22484: Resolved a performance issue in Yara tag processing that could affect the Server backlog process. (Server 8.11.2)
4. Consider increasing the API Timeout to give SQL Server more time to respond:
   1. Log in to the Console and navigate to https://ServerAddress/shepherd_config.php
   2. Select the property: API_TimeoutS
   3. Increase to 120 and save the change.
   4. Log in to the application server as the Carbon Black Service Account.
   5. Use an administrative command prompt to issue:

      iisreset

       

If the issue persists open a case with Support and provide the following details:

• Full steps on how to recreate the issue.
• Results from the SQL Server Disk Performance tests.
• Results from the latest CB Analysis Script.
• Recreate the issue while capturing High Debug Server Logs for Web Console or API Errors.

Additional Information

• Timeouts will still occur after increasing API_TimeoutS if SQL Server requires more than 2 minutes for the query to complete.
• Avoid setting 'API_TimeoutS' parameter higher than 120 as this could cause severe performance issues with Console.