Environment
Question
The site is set to throttle at 50 KB/s but uploads from individual sensors have been observed at over 200 KB/s. Why are the sensors not complying with the configured throttling rate?
Answer
Throttling is not performed per sensor. It is performed per site by the server. When sensors check in, the server tells them how much data to send and when to send it. The server will keep the average speed for the entire site at or below the configured rate but individual uploads are not throttled. It is normal to see individual uploads exceed the configured rate.
Additional Notes
Carbon Black Response (CbR) Site Throttling is a feature that allows for control of data upload speed to the server from sensors in a particular site. This is a separate feature from the default sensor throttling.
Sensor Throttling
CbR, by default, uses sensor throttling to control the rate at which data is submitted from the sensors to the server. Server utilization statistics are collected as well as information about the amount of data awaiting upload that is cached on the endpoints. A proprietary algorithm uses this data to determine the optimal transfer rate. When a sensor checks in, the server responds by telling it how much data to upload. Note: The server only tells the sensor how much data to send, not how fast to send it.
Site Throttling
Site throttling is an optional configuration that can control the amount of data being submitted over a given period of time by a specific subset of sensors. Because throttling works by controlling the amount of data sent, not the speed of the connection, there will be spikes in bandwidth utilization. The average speed over time, however, will not exceed the configured amount.
Related Content
Cb Response: Sensors Upgrading Faster Than Configured Settings
