Agent Failed to Read Config List From File

Products

• Carbon Black App Control

Issue/Introduction

• When attempting to manually import the Config List an error is returned similar to:

  Carbon Black App Control Agent failed to read Config List from file.

• Review of the Agent High Debug Logs during the import show messages similar to:

  Error[Error running query: Ret[0x00000001:0x00000001] Error[incomplete input] Query[INSERT OR REPLACE INTO main.dab 
  Exception Consuming config list file at start up.
  Failed to update state for dabs that are in extdab. Err: incomplete input at ..\b9CacheLib\b9CacheDatabase.cpp
  DATABASE: Successful Query[ROLLBACK TRANSACTION;] 
  DATABASE: Closed SQLite database: File[...programdata\bit9\parity agent\cache.db] Key[(null)]
  InitCache: ImportErrors[1]

Environment

• App Control Server: All Supported Versions
• App Control Agent: All Supported Verions

Cause

• When a Configlist entry (Custom Rule, Approval, Ban, etc) is created and associated with a specific Policy (or Policies) this creates a State Group mapping.
• There is a character limit of 2048 for these State Group mappings in the Das database. Even if a Policy is removed from a Rule, the State Group mapping will remain.

Resolution

1. Run SQL Server Management Studio as the Carbon Black Service Account.
2. Execute the following query to check if there are any state_group mappings getting close to the 2048 limit:

   USE das; SELECT state_groups, len(state_groups) [SG Length] FROM dbo.host_groups_state_groups WITH (nolock) ORDER BY [SG Length] DESC

3. If any State Group returned has a Length of 1900 or more: open a case with Support to request the scripts to scope unused State Group Mappings and prune them.

Additional Information

• The root cause is an overreliance on Custom Rules/Approvals per-Policy (as opposed to All Policies), which leads to a large number of State Group Mappings.
• There is a limit on how many mappings a Policy can have to a Rule or Approval.
• Even if a Policy is removed from a Custom Rule in the UI, the State Group Mapping remains. 
• "String or binary data would be truncated" error when creating or modifying a Custom Rule, Policy, Approval or a Ban