IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Cb Protection: Server Backlog Health Indicator released

Cb Protection: Server Backlog Health Indicator released

Server backlog Health Indicator has been released on Friday, March 24, 2017. All 7.2.1+ customers connected to CDC will receive this Health Indicator from the cloud.

This Health Indicator monitors the server backlog of file information received from agents. It triggers when excessive server backlog builds up. Normally this health indicator is invisible. When backlog starts growing and is more than 10% of the safe threshold this Health Indicator becomes visible. When backlog goes over the threshold it turns Red.

Temporary spikes because of mass software distribution like Windows updates should not cause this Health Indicator to trigger. These spikes are short lived and subside over a couple of days. This Health Indicator will help track the spikes and assess their impact on the server.

If this Health Indicator triggers please file a support case to investigate it further.

Indicator Logic (Subject to Refinement)

Severity

When

Invisible

Server backlog history is less than 3 days old or non-existent (The intent of this is to avoid going red during initialization).

OR

The current backlog size is less than 10% of the calculated threshold below (The intent of this is to hide awkward graphs when the backlog is always low on the x axis and the deployment is safe)

Red

Calculated Red Threshold = # of Active Agents * Average Cache Size * 10%

Final Red Threshold = Min(Calculated Red Threshold, 35000000) ←(The minimum of the calculated threshold and 35,000,000).

If the current backlog size is greater than or equal to the Final Red Threshold, this health indicator will display red severity.

Green

All other cases

Glossary of Terms

Server Backlog - Number of file operation messages that Cb Protection Server has received from agents and has yet to process. File operations include all operations on a file of interest such as adding, editing, deleting, copying, renaming a file. Typically server will always have backlog in thousands as it talks to agents in real time.

Active Agents - Agents that have talked to the server in the last 7 days.

Article Information
Author:
Creation Date:
‎03-23-2017
Views:
1783