EDR: Sensor_Registrations Table Grows To GB Sizes Within 3-5 Days

[#1]

Environment

• EDR Server: 7.1.1 and Higher

Symptoms

• Sensor_registrations table in postgres grows into the GB sizes within 3-5 days.
• Vacuuming of sensor_registrations table only temporarily resolves the sizing.

Cause

Number of concurrent connections to EDR Server is too high.

Resolution

1. Set the following configuration in /etc/cb/cb.conf: 

   SensorServicesWorkerConnections=5

2. Vacuum the sensor_registrations table in postgres: EDR: How to vacuum sensor related Postgres tables
3. Restart cb-enterprise services: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294

Additional Notes

If setting the SensorServicesWorkerConnections configuration to 5 or lower does not resolve the issue, please contact Support for assistance in running the EDR Qualifier Tool.

Related Content

• EDR: How to vacuum sensor related Postgres tables
• EDR: How to Restart Server Services