Failureid[165] Agent Has a Database That Is Growing Too Fast

Products

• Carbon Black App Control

Issue/Introduction

Agent is generating Health Check Events similar to:

Carbon Black App Control Agent detected a problem: Carbon Black App Control Agent has a database that is growing too fast. (From xxxx bytes to yyyy bytes in zzzz seconds). Options[00000003] TotalFailures[1] FailureId[165] FailureId[165]

Environment

• App Control Linux Agent: All Supported Versions

Cause

Agent's cache is growing faster than expected by a configurable growth rate.

Resolution

There are a number of circumstances that could cause the Agent to trigger this Health Check, however in general this is caused by a sudden increase in file inventory/analysis on the endpoint.

1. Agent recently installed
   
   • This Event is likely temporary in nature and will subside after Initialization has completed.
2. Agent conducting Cache Consistency Check
   • This Event is likely temporary in nature and will subside after the C3 has completed.
3. Verify the Linux System Performance Rapid Config is enabled and configured accordingly for the environment.
4. If some build process is happening, the Agent could be analyzing a sudden increase in files.
   • If the files being built during this process are non-executable or otherwise not interesting, consider a Performance Optimization Rule.
5. Consider adding an Agent Config to override the default value
   1. Log in to the Console and navigate to https://ServerAddress/agent_config.php
   2. Click Show Filters > Value > contains: max_cache_growth
   3. Click Apply
   4. Edit the existing Agent Config, or click Add Agent Config if none present.
      • Property Name: Cache Growth Percentage For Health Check
      • Host ID: 0
      • Value:

        max_cache_growth_rate_percentage_for_health_check=85

      • Platform: Linux
      • Status: Enabled
      • Create For: All Current & Future Policies

Additional Information

• This Health Check Event is a Low Severity Event and is not immediate cause for concern, especially if no other symptoms are present.
• By default this Config Prop is not present in the Agent Config, however adding one will override the hardcoded default.
  • Deleting an Agent Config with this Value will revert to the hardcoded default

    max_cache_growth_rate_percentage_for_health_check=50