Cb Response: Binary Files Still Uploading After Collection Type Disabled
Cb Response 6.1.2
Following binary collection being disabled, there is still elevated bandwidth being used by Cb Response Sensor Communication.
Unselecting this option in the sensor group settings means that the sensor no longer collects any new binary files, but still tries to upload the files already collected.
Binaries that have already been collected can be removed from the sensor, they are located in C:\Windows\CarbonBlack\store
Note: Admin Privileges are required to access this directory
Warning: The catalog file should not be removed from this directory
Sensors should be upgraded to the latest release
6.1.2-win sensor release resolves CB-15259. This issue causes the Windows sensor to excessively retry calls to our “reserve” api (used to reserve space for data uploads) when no space is available. This could cause an increase in overhead in past sensor versions.
Site throttling in the 6.X server is not compatible with 5.X sensors.
6.x sensors are more efficient at submitting data to the Cb Response server than 5.x sensors.
As an additional note, the throttle algorithm calculations are based on rolling averages, so it is expected that there may be brief periods where the limits can be exceeded.