Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

App Control: Carbon Black File Reputation Reporting Slow Synchronization

App Control: Carbon Black File Reputation Reporting Slow Synchronization

Environment

  • App Control Console: All Supported Versions
  • Carbon Black File Reputation service

Symptoms

  • Slow synchronization reported with the Carbon Black File Reputation service
  • Filename and/or pathname table(s) will show increase in size

Cause

  • ABExclusionRules' rule added to Server is not configured properly
  • Max character length of the ABExclusionRules' rule is reached 

Resolution

Warning: Editing AbExclusions can affect the data sent to and from the agents. If unsure on the edits, please contact Carbon Black technical support

ABExclusionRules' rule added to Server is not configured properly:
  1. Navigate to https:// <SERVERNAME>/support.php?tab=abex&menu
  2. Validate that all of the listed AbExclusions, match the formatting requirements in the description box
  3. Correct any mistakes found and click save
Max character length of the ABExclusionRules' rule is reached 
  1. On older releases (Pre-8.x) the value for AbExclusions after encryption is 2048 characters. Query the following values to validate the number is less than 2048
select len(value), name from dbo.shepherd_configs (nolock) where name like '%ABExclusion%'
  1. If a value is over the 2048 character limit, decrease the number of exclusions within the https:// <SERVERNAME>/support.php?tab=abex&menu table

Additional Notes

  •  2048 is the max character length of the 'ABExclusionRules' rule within older releases

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-24-2022
Views:
480
Contributors