Version
Cb Response 6.x Sensors
Issue
Sensor Health Scores reporting elevated ram usage
Cause
Versions 6.0 and 6.1 of the Response server can retain significantly more information than earlier versions. This increased retention is partly due to the fact that the server is now provided complete datasets by the sensor.
Earlier versions of the sensor constantly sent partial data to the server (which would then have to coalesce these incomplete data segments into coherent wholes, an operation that required storage space and processing time).
Instead, the new sensors store more information locally (e.g. maintaining the state of parent processes, incomplete process metadata, tracking potentially-suppressed processes, etc.) and then organize it into complete segments prior to sending the information to the server. This means that 6.0 and higher versions of cb.exe may have a larger memory footprint and higher CPU utilization when compared to earlier versions.
The latest version of the sensors, 6.1.2-win and 6.1.2-osx, improves reporting of process memory by periodically calling memory manager functions to clean up memory overhead caused by fragmentation. The operating system often can hold onto unused memory for performance reasons and report higher consumption than the program is actually using.
Resolution
Reported elevated memory usage is expected in 6.x sensors, although upgrading to 6.1.2-win and 6.1.2-osx should reduce reported usage. Sensor Health Scores will be significantly revised in a future version of the product.
