Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Agent Causing Long Delays When Saving to a Network Share

App Control: Agent Causing Long Delays When Saving to a Network Share

Environment

  • App Control Agent: All Versions
  • Microsoft Windows: All Supported Versions

Symptoms

  • Slower than average writes to network shared drives. 
  • Longer times saving and opening Microsoft Office documents. 

Cause

This issue is caused by a normalization attempt by the App Control Agent, attempting to find if the path is a DFS share. 

Resolution

  1. Open the App Control console. 
  2. Navigate to Assets > Computers and select the device having the issue. 
  3. In the URL save the Host_ID listed. 
  4. Change the URL to https://<SERVERNAME>/Agent_config.php
  5. Click Add Agent Config and enter in the following details:
    • Property Name: Network Share DFS Check
    • Host ID: Enter the number from step 3. Otherwise 0 will apply to all devices. 
    • Value: kernelUseSimpleDFSCheck=0
    • Status: Enabled
  6. Save and wait for the device to become up to date on its CL rules. 

Additional Notes

Although very rare, some considerations should be known regarding the changing of these values:
  1. When kernelUseSimpleDFSCheck=1 is set:
    • Incorrectly processing a path as DFS will result in an invalid pathname which hurts performance due, as opening non-existent files on the network is costly.  
  2. When kernelUseSimpleDFSCheck=0 is set:
    • It is possible to incorrectly identify DFS served file paths. This will cause file normalization to fail and may result in blocks due to the lack of a file hash.

 

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-26-2018
Views:
2112
Contributors