Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Individual file information might be incomplete because tracking of individual files is disabled

Individual file information might be incomplete because tracking of individual files is disabled

 

Version

6.0.2.x

7.x

Issue

When viewing Files list in the Bit9 Console (Find Files, Files on Computer) the following message is presented at the bottom of the page:

"Notice: Individual file information might be incomplete because tracking of individual files is disabled"


Symptoms

For a newly installed Bit9 agent, there will be no files showing on the list for this computer. However, the computer is 100% initialized and synchronized and there is no backlog. For long time installed Bit9 agents, files on the list may not be up to date.


Cause

This can happen only when SQL Express is installed:

If the DAS database is installed on SQL Express and the database is reaching the size that is set under the shepherd config parameter: DisableTrackingCutoffDatabaseSizeMB, then the shepherd config parameter: TrackFileInstances will automatically be modified from True to False and the issue will occur.

This is done to protect the DAS database, as the SQL Express has its size limitations.

By default, the value of DisableTrackingCutoffDatabaseSizeMB is set to 3.5Gb and only when SQL Express is installed.


Solution

1. Open shepherd_config.php  (https://<bit9 server>/shepherd_config.php) and verify that the parameter TrackFileInstances is indeed set to False.

2. Change the value of DisableTrackingCutoffDatabaseSizeMB to up to 8000 or 9000 MB (if this is SQL Server 2008, assuming it has limit of 10G size).

3. Change the value of MaxDatabaseSizeMB to 7500MB (if this is SQL Server 2008, assuming it has limit of 10G size).

3. After this is done modify the parameter TrackFileInstances back to True.

4. Run CC2 (Rescan Known Files) on the endpoints to get the missing files to show up.

5. Encourage the customer to move the DAS database from SQL Express to a Standard edition if the database size limitations do not fit the installation size and growth.


Important Note(s)

To see the changes made to those parameters, and also to track when the parameter TrackFileInstances was changed to False go to : https://<Bit9 Server>/configuration-changes.php

Labels (1)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎12-18-2015
Views:
709
Contributors