The VMware Carbon Black Tech Zone is live! Checkout this great resource: Mastering Carbon Black Audit & Remediation.

DB_Rep Size query

Description: This query looks for the DB_rep file for CB Defense and pulls back the size

What The Data Shows: When this file grows too large it can cause performance issues related to reputation lookups

SQL:

SELECT size/1048576 AS "size (MB)",
    CASE
        WHEN size/1048576 <= 100 THEN "NORMAL"
        WHEN size/1048576 > 100 THEN "LARGE"
        WHEN size/1048576 > 1000 THEN "HUGE"
    END "db_rep STATUS"
FROM file
WHERE PATH"c:\program files\confer\db_rep";
0 Votes
3 Comments
jnelson
Carbon Black Employee
Status changed to: Under Review

@ryan_manni Could I make a suggestion on your query? How about we add some logic to indicate what is NORMAL, LARGE, or HUGE?

SELECT size/1048576 AS "size (MB)",
    CASE
        WHEN size/1048576 <= 100 THEN "NORMAL"
        WHEN size/1048576 > 100 THEN "LARGE"
        WHEN size/1048576 > 1000 THEN "HUGE"
    END "db_rep STATUS"
FROM file
WHERE PATH= "c:\program files\confer\db_rep";
 
This give you an output like:
+---------------+---------------------+
| size (MB)      | db_rep STATUS |
+---------------+---------------------+
| 6                     | NORMAL               |
+--------------+----------------------+
ryan_manni
Frequent Contributor II

@jnelson That's great!  I wasn't sure on specifics but its come up in a few support cases so I thought this would be a good hygiene query to allow admins to be proactive with sensors having potential issues. 

jnelson
Carbon Black Employee
Status changed to: Approved