User suspects that there are interoperability issues between the VMware Carbon Black Cloud sensor and another program installed on an endpoint.
VMware Carbon Black Cloud Sensor
VMware Carbon Black EDR Sensor
Microsoft Windows: All supported versions
Resolution for a Procmon for Sensor Performance
- Download the latest Process Monitor (Procmon) from sysinternals
- Unzip and place Procmon in an easy to find location
- Open Procmon and Press Ctrl+E to stop the capture
- Go to Options > Profiling Events > Generate Thread Profiling every second
- Go to Filter and uncheck the filtering "Process Name is System"
- Start the capture (Ctrl+E) when ready to reproduce
- After reproduction, stop the capture (Ctrl+E).
- Save the file as .PML, then when prompted, select "All Events" and "OK".
- Zip the PML file before sending to reduce the size
Resolution for a Low Altitude Procmon Capture
VMware has provided a script that will capture the necessary data sets for investigating potential interoperability issues. Download the attached document, which contains the instructions for executing this process, as well as the corresponding files at the bottom of this article.