Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance

Carbon Black Cloud: How To Use ConfigProps To Tune DFS Normalization Performance

Environment

  • CB Defense Sensor: 3.5.0.1646+ and Higher
  • Microsoft Windows: All Supported Versions

Objective


How to use ConfigProps to tune DFS path normalization performance delays

Resolution

If you are experiencing delays when accessing files across a DFS network, enable the new heuristic changes (these two entries not needed for 3.6+ as they enabled by default) by adding / modifying the following in the cfg.ini using this KB:
SkipNetworkConversionToPhysical=0
OnlyAttemptDFSForPhysicalDeviceNames=1
Alternatively if a DFS file share stops functioning you can force DFS normalization by adding:
NormalizeAlwaysDFSPatterns=<path to server>

example: NormalizeAlwaysDFSPatterns=**servername**
Of if a non-DFS file share that is experiencing delays specify an ignore path to the server by adding:
NormalizeNeverDFSPatterns:<path to server> 

example: NormalizeNeverDFSPatterns=**servername**

Additional Notes

Note: Using SkipNetworkConversionToPhysical=1 or OnlyAttemptDFSForPhysicalDeviceNames=1 in 3.5.0.1627 may cause a crash which will be addressed in the next release

  • New ConfigProp functionality has been added in 3.5.0.1627+ to help reduce DFS path normalization performance impact on network files path greater than four directories deep.
  • These changes can be added via cfg.ini in 3.5.0.1627+ or by using the Rules Management System when released.

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-04-2020
Views:
1810
Contributors