Collect Agent Logs for Slow Boot or Slow Logons

Products

• Carbon Black App Control

Issue/Introduction

Steps to collect Agent logs for slow boot or logon times.

Environment

• App Control Agent: All Supported Versions
• Microsoft Windows: All Supported Versions

Resolution

Collect Relevant Background Information

The following details should be included when providing the logs:

1. Operating System version/build?
2. Physical or virtual machine?
   • If virtual, persistent or non-persistent clones?
   • What virtualization (Citrix, Horizon, etc) is being used?
   • When was the last time the Golden Image was updated?
3. When did the issue start?
4. Are any Block Events also observed during the boot?
5. What is the average boot or logon time with Agent fully operational?
   
   • Temporarily disable the Agent following these steps, and note the time difference:
   • Use an administrative command prompt to issue the following commands in an administrative command prompt:

     cd "C:\Program Files (x86)\Bit9\Parity Agent"
     dascli password GlobalPassword
     dascli tamperprotect 0
     net stop parity
     fltmc unload paritydriver
     sc config parity start= disabled
     sc config paritydriver start= disabled

   • Begin a stopwatch, reboot the endpoint and log in. Note the time to completion.
   • Fully re-enable the Agent using these commands in an administrative command prompt:

     sc config paritydriver start= boot
     sc config parity start= auto
     fltmc load paritydriver
     net start parity

Configure & Capture Agent Logs

When adjusting the Agent configuration using the command line, settings do not persist a reboot. Because of this, the settings must be set from the App Control Console to be sure they persist a reboot.

1. Log in to the Console and navigate to Assets > Computers > relevant Computer.
   • Important: If this is for troubleshooting issues with Non-persistent Clones be sure the Golden Image is properly chosen.
2. In the URL, note the value for host_id (example: https://<ServerAddress>/host-details.php?host_id=74)
3. From the Computer Details page > right hand side > Advanced > Set Debug Level:
   • Debug Level: High & Include Kernel
   • Debug Duration: Permanent
   • Click GO
4. Navigate to https://<ServerAddress>/agent_config.php > Add Agent Config
5. Use the following details:
   • Property Name: TMP-Max Roll QTY (or something memorable)
   • Host ID: Value from Step 2 (ex: 74)
   • Value: max_rolled_trace_logs_to_keep=20
   • Status: Enabled
6. Click Save & add another Agent Config using the following details:
   • Property Name: TMP-Max Roll Size (or something memorable)
   • Host ID: Value from Step 2 (ex: 74)
   • Value: max_rolling_trace_size_mb=500
   • Status: Enabled
7. Verify the Agent shows as Connected and Up to Date.
8. Important: If Non-persistent Clones
   • All above steps should have been on the Golden Image so the Clone will start with all configs in place.
   • If Citrix Non-persistent Clones: Follow the steps for Creating a Template Computer
   • If Horizon Instant Clones: Follow the steps for Creating a Template Image
9. Reboot the endpoint and log back in
   • If Non-persistent Clones, after the Golden Image is updated accordingly start a Clone and log in.
10. Use a command prompt to capture the Agent Logs:

    cd "C:\Program Files (x86)\Bit9\Parity Agent"
    dascli capture "%userprofile%\Desktop\%computername%-SlowBoot.zip"

11. Navigate back to Assets > Computers > relevant Computer > right hand side > Advanced > Set Debug Level > None (default).
12. Disable the Agent Configs created in Steps 5, 6, and 7.
13. Capture a Boot Windows Performance Recorder Trace
    • Important: This must be done separately from the Agent Debug Logs
    • If troubleshooting boot timings with Non-persistent Clones the Golden Image must be updated with the Debug Logging removed and the WPR Boot Trace accordingly.
    • Be sure to zip the resulting WPR Trace before providing to Support.
14. Provide the Relevant Background Details (including timing differences) and all captured logs to Support.