The best choice for clone inventory will depend upon your environment and your priorities. The most obvious advantages of choosing to inventory only new and modified files are a reduction in network and server traffic and minimization of data that might not be of interest to you. This can be particularly important in an environment with thousands of cloned computers and a large base image of files.
Balance limitation of traffic against the impact of limiting the clone inventory. If new and modified files is chosen:
- Neither the Find Files page nor the Files on Computers page will be able to show all files on a clone computer.
- Drift reports that involve cloned machines will be incomplete. The only type of drift reporting that will work correctly is self-drift (comparison of the files currently on the clone computer with its own previous inventory), and unmodified files from the initial template image will not be included in this report.
- Snapshots created from cloned computers will include only new and modified files.
- File prevalence will not be accurate for unmodified files from the template image because instances on clones will not be counted (and also deletion of files from the original image will not be accounted for).
- Because unmodified files in the template image will not be visible in the clone computer’s inventory, direct local approval of such files will require that the specific file instance (on the specific clone computer) appears in an event. Otherwise, global approval might be required.
Note:
Carbon Black App Control also provides an option to exclude tracking of certain Microsoft-signed operating system and application files, and this can significantly reduce traffic and database demands. This affects all computers, not just clones. See
Excluding Tracking of Microsoft Support Files for more details.
Configure the Clone Inventory Setting for a Template
Follow this procedure to modify the clone inventory settings for a template.