Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Sensor_Registrations Table Grows To GB Sizes Within 3-5 Days

EDR: Sensor_Registrations Table Grows To GB Sizes Within 3-5 Days

Environment

  • EDR Server: 7.1.1 and Higher

Symptoms

  • Sensor_registrations table in postgres grows into the GB sizes within 3-5 days.
  • Vacuuming of sensor_registrations table only temporarily resolves the sizing.

Cause

Number of concurrent connections to EDR Server is too high.

Resolution

  1. Set the following configuration in /etc/cb/cb.conf: 
    SensorServicesWorkerConnections=5
  2. Vacuum the sensor_registrations table in postgres: EDR: How to vacuum sensor related Postgres tables
  3. Restart cb-enterprise services: https://community.carbonblack.com/t5/Knowledge-Base/EDR-How-to-Restart-Server-Services/ta-p/41294

Additional Notes

If setting the SensorServicesWorkerConnections configuration to 5 or lower does not resolve the issue, please contact Support for assistance in running the EDR Qualifier Tool.

Related Content


Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-12-2021
Views:
376
Contributors