Before testing this fix, please verify that you have the proper antivirus exclusions in place. Lack of exclusions can also cause high CPU usage. You can view the necessary exclusions here.

Issue 

This issue affects Windows machines with high netconns, most often domain controllers, DHCP servers, and DNS servers. Name resolution can cause the collection of netconn data to take additional CPU/memory resources to complete the task.

Resolution

  1. In order to implement this fix, you must have 6.1.4-win sensor or greater.
  2. Add the following registry key:
[HKEY_LOCAL_MACHINE\SOFTWARE\CarbonBlack\config] "DisableNetConnNameResolution"=dword:00000001
  • For large deployments, you can script the change using reg add:
reg add hklm\software\carbonblack\config /v DisableNetConnNameResolution /t REG_DWORD /d 0x00000001
  • For new installations, open sensorsettings.ini found in the install package and add the following parameter to the bottom:
DisableNetConnNameResolution=1

Once you have added the registry key, you will need to restart the machine.

If this does not alleviate your issue, please contact us at support@redcanary.com. 

Did this answer your question?