This page is an aggregate of all OER topics onto a single page for more convenient HTML viewing.

App Control Server: Supported Operating Systems

Operating System Architecture Service Pack Additional Notes/Requirements
Windows Server 2012 R2 x64 Use Latest HVM Virtualization only
Windows Server 2016 x64 Use Latest HVM Virtualization only
Windows Server 2019 x64 Use Latest HVM Virtualization only
Windows Server 2022 x64 Use Latest HVM Virtualization only

App Control Server: Cloud Deployments

The App Control server can be deployed within cloud services.

VMware Carbon Black has successfully deployed App Control to AWS and can support the product in that environment. App Control can also be deployed to other cloud providers like Azure and Google Cloud, however, we have not validated deployment with our own internal testing.

We will provide best level of effort in supporting customers when deploying to these cloud services but we cannot guarantee success. If provisioned cloud storage is validated with the CBPTest Tool, we anticipate a successful deployment in that environment.

Note: You can find information regarding the CBPTest Tool in the latest version of the SQL Server Configuration Guide.

App Control Database: Supported SQL Server Versions

Database System Architecture Service Pack / Cumulative Update
SQL Server 2012 x64 Use Latest
SQL Server 2014 x64 Use Latest
SQL Server 2016 X64 Use Latest
SQL Server 2017 X64 Use Latest
SQL Server 2019 X64

Use Latest

Important: Installation of the latest Cumulative Update is required.

(This is due to new feature in SQL Server 2019, inlining scalar-valued user-defined functions, which causes major issues without the latest Cumulative Update.)

App Control Database: MS SQL Server Usage

Database System Architecture Additional Notes/Requirements

SQL Server Express

 x64

Limited to 1 CPU Socket (or 4 cores)

Maximum memory utilized: 1Gb

Maximum database size: 10Gb
SQL Server Standard x64 Standard edition for < 30K endpoints, Enterprise edition for larger deployments. See “App Control Server Architecture by Endpoint Count” below for more details.
SQL Server Enterprise x64 Standard edition for < 30K endpoints, Enterprise edition for larger deployments. See “App Control Server Architecture by Endpoint Count” below for more details.

App Control Database: AWS RDS MS SQL Server Usage

Database System Architecture Additional Notes/Requirements

SQL Server Express

 x64

Limited to 1 CPU Socket (or 4 cores)

Maximum memory utilized: 1Gb

Maximum database size: 10Gb
SQL Server Standard x64 Standard edition for < 10K endpoints, Enterprise edition for larger deployments. See “App Control Server Architecture by Endpoint Count” below for more details.
SQL Server Enterprise x64 Standard edition for < 10K endpoints, Enterprise edition for larger deployments. See “App Control Server Architecture by Endpoint Count” below for more details.

App Control Web Server Platform: Support Server

Common Requirements Restrictions

In the IIS Roles Manager, verify the following configuration:

  • Common HTTP Features:
    • Static Content
    • Default Document
    • HTTP Errors
    • HTTP Redirection
  • Application development:
    • ASP.NET (version 4.5)
    • .NET Extensibility (version 4.5)
    • CGI
    • ISAPI Extensions
    • ISAPI Filters
  • Health & Diagnostics:
    • HTTP Logging
    • Logging Tools
    • Request Monitor
    • Tracing
  • Security:
    • URL Authorization
    • Request Filtering
    • IP and Domain Restrictions
  • Performance: None
  • Management Tools:
    • IIS Management Console
    • IIS Management Scripts and Tools
    • Management Service
  • FTP Publishing Service: None

Beginning with v8.0.0, the console relies on the App Control API. An incorrectly configured IIS server can prevent console access.

  • To confirm API functionality: go to System Configuration > Advanced Options in your current console and check the “API Access Enabled” box. If a green dot appears next to the checkbox, then you can assume that IIS is configured correctly. Otherwise, make sure you meet the following restrictions:
  • Site Bindings:

    The App Control API will not connect to localhost if the console web application is bound to a specific IP address instead of ‘*’. Make sure that ‘*’ is added to the list of bindings.

  • IP Address and Domain Restrictions:

    If you must limit console access to specific IP addresses, be sure that the IPv6 localhost address is added to the list.

  • Application Pools:

    App Control must be run within the DefaultAppPool application pool. Using a different app pool results in the App Control server not having the appropriate credentials to access the SQL Server database.

  • Authentication:

    You must disable Basic Authentication and Windows Authentication so that the App Control Server handles authentication. Otherwise, users will not be able to log into the App Control Server.
Version Part Of OS Supported Architecture Supported Level Additional Notes/Requirements
IIS 8.5 Windows Server 2021 R2 only x64

Common Requirements and Restrictions are listed in the table above

Additional requirements: Private memory for IIS should be increased to 800 MB
IIS 10 Windows Server 2016 / 2019 / 2022 X64

Common Requirements and Restrictions are listed in the table above

Additional requirements: Private memory for IIS should be increased to 800 MB

App Control Console: Supported Browsers

Browser Version Additional Notes/Requirements
Microsoft Edge Latest Windows only
Mozilla Firefox Latest Windows, Mac or Linux
Google Chrome Latest Windows, Mac or Linux
Safari 13 Mac

App Control Server System Requirements

  • Clean operating system installation, with the latest version/patch/service pack.
  • Microsoft IIS:  Version corresponding to the Windows Server installed. Configured as described in the Installing App Control Server guide.
  • Microsoft .NET: Version 4.8 framework with latest patch level.
  • Microsoft Installer: Version 4.5 or newer.
  • Processor:  Intel Xeon/i7 processor/multi-core running at least 2.5GHz. Although Intel processor is recommended, it is possible to use equivalent AMD processor.
  • Ethernet connection: 1 Gbps or faster connection required.

App Control Server Architecture by Endpoint Count

The App Control Server should be deployed on a single computer that will house both the App Control Server and SQL Server. The following table lists the requirements for this computer.

Endpoints SQL Server Edition Hardware Required Database Storage DAS (Locally attached) PCIe Flash GB / 1K EPTS

Note 2
RAM (GB) CPU Cores

Note 1

 SQL 2016 & Earlier SQL 2016 SP1 & Later

Note 4

 Disks RAID
Up to 100 Express 4 2 20 GB

Note 3

 20 GB

Note3

 2 1 n/a
101 – 250 Standard 12 2 55 GB 50 GB 4 1+0 n/a
251 - 500 16 2 100 GB 90 GB 4 1+0 n/a
501 – 1,000 16 4 175 GB 150 GB 6 1+0 n/a
1,001 – 1,500 16 4 300 GB 260 GB 6 1+0 n/a
1,501 – 2,000 16 4 500 GB 440 GB 8 1+0 n/a
2,001 – 5,000 32 6 1 TB 900 GB 8 1+0 n/a
5,001 - 10,000 48 8 1.2 TB 1 TB 12 1+0 n/a
10,001 – 20,000 48 8 2 TB 1.75 TB 14 1+0 50
20,001 – 30,000 128 16 3 TB 2.5 TB 24 1+0 50
10,001 - 40,000 Enterprise 64 12 2 TB 2 TB 12 1+0 20
40,001 - 80,000 96 16 4 TB 4 TB 14 1+0 20
80,001 - 160,000 96 16 8 TB 8 TB 22 1+0 20

Notes:

1 CPU core requirements are based on physical, not hyper-threaded cores. Two CPUs might be necessary to reach required number of cores.

2 PCIe sizing requirement is given in GB per 1K endpoints.

3 Database storage for SQL Express includes 10 GB for data file (maximum limit for SQL Express) and additional 10 GB for the log file.

4 Index compression will only be enabled for new installs. Upgrades should reference the SQL 2016 and Earlier column.

Important: You should test your architecture using the CBPTest Disk Performance Tool available on the user exchange.

Associated with the storage sizes listed above are the following caveats:

  • By default, the App Control Server saves no more than four weeks of events and no more than ten million events. Increasing these defaults will increase the size of the database. Under normal circum­stances, the largest portion of the database will be taken up with storage of instances of files on endpoints.
  • The App Control Server carries out two scheduled database tasks described in the document VMware Carbon Black App Control SQL Server Configuration Guide. Stopping these tasks can cause the database to grow beyond the sizes listed above.

The steps listed under “Database Growth” in the document VMware Carbon Black App Control SQL Server Configuration Guide are being followed.

Notes on SQL Server Edition

Deployments with 10,000 to 30,000 endpoints have a choice of SQL Server editions. When using SQL Server Standard, keep the following points in mind:

  • With over 20,000 endpoints, SQL Server 2014, 2016, 2017, or 2019 must be used. Earlier versions of SQL Server Standard do not support enough RAM or CPU Cores.
  • Unlike SQL Server Enterprise, SQL Server Standard prior to SQL Server 2016 SP1 does not use data compression. This is why it needs more memory and disk space.
  • On SQL Server Standard, App Control achieves equivalent performance processing file inventory compared to SQL Server Enterprise, but the App Control console can be 30% slower and some database maintenance tasks such as rebuilding indexes and statistics will be slower. This can be mitigated by placing the database on faster storage hardware.

Two-tier Deployment Architecture

Here are the requirements for a two-tier installation of App Control where the App Control Server and SQL Server reside on separate hardware:

  1. For the SQL Server hardware, use the single-tier table above.
  2. For the App Control Server hardware, use the following table:
    Endpoints Hardware
    RAM (GB) CPU Cores Note 1
    Up to 1,000 4 2
    1,001 - 80,000 8 4
    Above 80,000 16 8

    Note 1: CPU core requirements are based on physical, not hyper-threaded cores. Two CPUs might be necessary to reach required number of cores.

  3. Make sure that the network latency between the App Control Server and SQL Server is 0.7 ms or lower. The freeware utility hrPing or similar can be used to validate the latency.
  4. The SQL server instance and underlying database storage has to be dedicated to the App Control Server

App Control Database: SQL Storage Requirements

The SQL database should meet the following requirements:

  • The OS and paging file must be on a separate physical partition from the SQL database. Use of two additional disk drives configured as a RAID-1 partition (mirror) is recommended.
  • Any AV software must be configured to exclude SQL data directories.
  • Direct attached storage (DAS) is required, using a 6 GB/s SAS (Serial Attached SCSI) adapter or better.
  • All hard drives must be 2.5" in size, and have rotational speed of 15K RPM. Note that for deployments larger than 40,000 endpoints, 10K RPM drives can be used if the total required disk size requirement cannot be met with available 15K RPM drives.
  • RAID-10 should be used with DAS drives
    • Stripe element size: 64 KB
    • Controller cache-write policy: “Write Back”
  • Performance of SQL storage should be validated with the CBPTest tool prior to deployment of App Control Server.
  • When PCIe Flash storage is not used, the entire database (data + log + indexes + temp) should be on the single large DAS partition. Total disk space shown in the table above includes both hard drive and flash drive space.
  • The table shows that Enterprise SQL server requires less storage per endpoint. The reason is that this edition of SQL server supports compression, which reduces storage requirements for more than 50%.

Special considerations for PCIe (PCI-express) flash storage:

  • Use of a PCIe card is required when noted in the sizing table.
  • Carbon Black recommends a NVMe x8 MU Card[See Note 1] from any major vendor.
  • When PCIe Flash storage is used, you should partition the database so that indexes go to the flash storage partition and all other files (data + log + temp) go to the single large DAS partition. Check table above for PCIe card space requirements per 1K endpoints.
  • Even though it is not required, in order to further improve product performance, the entire database except for the log file (data + indexes + temp) can be moved to flash storage. Security teams who require extremely fast search response times may opt for such an option. This will require 100 GB of flash storage for every 1K endpoints for SQL Standard edition, or 50GB per 1K endpoints for SQL Enterprise edition.
  • When PCIe flash storage is used, card airflow requirements have to be met by the hardware box.
  • Transaction logs should remain on SAS disks or other storage optimized for sequential writes.

[Note 1]:

1 NVMe = non-volatile memory express

X8 = motherboard PCIe 3.0 or 4.0 - x8 interface

MU = mixed use

Card = usually a half height form factor (looks like a graphics card)

App Control Database: SQL Memory Configuration

Since the App Control Server database is relatively large, SQL Server will take all the RAM it has at its disposal, potentially leading to system memory starvation. For that reason, a SQL Server memory cap should always be set on SQL Server. On systems with 16GB RAM, set the memory cap to 12GB. For systems with more RAM, make sure that the SQL maximum server memory is set to at least 5 GB less than the total RAM installed in the system for SQL Server Standard, and 10 GB for SQL Server Enterprise edition.

Note: In a small configuration with SQL Server Express, there is no need to set a SQL memory cap because SQL Server Express already limits memory use to 1 GB.

App Control Database: SQL Maintenance

App Control Server does its own scheduled SQL DB Maintenance tasks on daily and weekly basis. This functionality is important in order to maintain database performance and limit growth. The maintenance tasks include:

  • Deleting obsolete data
  • Defragmenting indexes
  • Rebuilding statistics
Note: Use of any other, custom maintenance tasks would be counter-productive and should be avoided.

App Control Database: SQL Backups

The App Control database uses the “Simple” recovery model. The “Full” recovery model should not be used to avoid a performance penalty and excessive database log growth.

Note: The use of a SQL Server Availability Group Listener has been verified as a valid Database Server option during App Control Server installation. Design and implementation of a SQL Server Always On availability group is outside the scope of this document.

App Control Server supports automated database backups, but only for deployments up to 100 endpoints. In all other cases, full database backups should be done using best SQL server practices. Also, a database consistency check should be done prior to backup to ensure that the database is not corrupt.

Recommended backup frequency is 2-3 full backups per week. More frequent backups might negatively impact server performance.

Database backup can run anywhere from minutes to hours, depending on database size, network speed (when backups are sent over the network) and performance backup storage. Backups impact server performance should be avoided during busy times (e.g. when many users rely on console performance), or during internal App Control Server maintenance times (see table below).

Maintenance Task Times
Daily Cleanup Task Every day at 12 AM (midnight), App Control Server local time. Task can run anywhere from 1 to 4 hours.
Database Index Maintenance Every Saturday starting at 4 AM. Task can run anywhere from 2 to 6 hours.

App Control Server: Virtualization

App Control supports the use of virtualized environments for its deployment if the environment is smaller than 5,000 endpoints. Virtual environments must meet the minimum hardware configurations listed in the tables above, and also must meet the following requirements:

  • VMware ESX Server 5.5U2+; recommend patching to current level
  • SQL and App Control Server must be installed on the same virtual machine
  • Memory must be allocated as “reserved”
  • For virtualized servers, the underlying disk architecture must still meet aforementioned minimum requirements. Physical DAS storage, solely dedicated to the App Control VM, is preferred, but SAN storage may be used instead, if it meets these criteria:
    • IO channel: Fibre channel
    • Sequential write latency: 0.85ms or faster
      • Measured as 40kb writes, one thread, over two hours
    • Random write latency: 1.75ms or faster
      • Measured as 8kb writes, 32 threads, over two hours

    15K SAS drives for SQL logs and SSD drives for the other SQL storage should meet these criteria.

App Control Server: Common Performance Pitfalls

There are several pitfalls when purchasing and configuring hardware for the App Control Server. This section lists most common mistakes.

Category Problem Explanation Possible Mitigations
Slow SQL Storage Misconfigured or slow storage used for SQL database files can significantly impact the ability of the server to process agent events and file changes and can cause a backlog of server tasks and slow console response.
  1. Use direct-attached storage with correctly sized disks and RAID architecture
  2. Avoid using SAN storage due to high latency
  3. For larger deployments, use fast SSD/Flash storage, as documented
Slow Network A slow network connection between the App Control Server and SQL Server can significantly impact the ability of the server to process agent events and files. This can cause a backlog of messages and loss of visibility into the agent inventory and operation.
  1. Deploy App Control in a 1-tier model, with both the App Control server and SQL Server on the single machine
  2. Reduce network latency between App Control and SQL server by using fewer, faster switches, or a direct cable connection
Resource Sharing Shared SQL server or SQL storage layer can impact overall server performance because the server cannot utilize hardware resources as needed. Also, sharing introduces a varying load which makes it impossible to predict future server performance.
  1. Provide a dedicated SQL server instance to the App Control
  2. Provide dedicated storage to App Control SQL storage files, not used by either other databases or other applications
Hardware Virtualization

Improperly virtualized server hardware or virtualizing the server for a large number of endpoints can impact the overall server performance. The impact can be on either the network, CPU, memory or storage layer.

As a reminder, virtualization is supported only below 5,000 endpoints.
  1. Move product to physical hardware
  2. Move product to 1-tier virtual hardware
  3. Ensure that the virtual machine satisfies OER requirements (CPU, Memory), uses physical storage, and that there is very low latency between the App Control and SQL servers in case of 2-tier deployment

App Control Server: Communication Requirements

Requirement Details Additional Notes
Port 443 access Outbound SSL From App Control Server to App Control Knowledge Allow connection to services.bit9.com (proxy connections are supported)
Inbound HTTPS from App Control Console users and App Control Agents (for software upgrades)
Inbound Port 41002 access Inbound SSL from App Control agents Port is configurable
Outbound Port 514 access Outbound UDP for Syslog/SIEM connections Optional, if Syslog/SIEM integrations are enabled. Port is configurable
Ethernet connection 1 GB/s connection required for connection to App Control Agents
Static IP address only (no DHCP) with an assigned FQDN or alias; IPv4 and/or IPv6 supported
AD Integration Server must be a member of a domain if AD integration is utilized
Bandwidth For every 1000 agents, you can expect server bandwidth to average about:

• Inbound: 200kb/s

• Outbound: 50kb/s

Server Release Lifecycle Status

Use the following table to determine the product lifecycle stage of your VMware Carbon Black App Control Server software.

Versions not listed are in the status: End of Life.

See VMware Carbon Black App Control Support Policy for product lifecycle information.

Table 1. Server Software in Status: Standard Support
Release GA Enter Standard Enter Extended Enter End of Life
8.9.x 9/2022 9/2022 3/2024 3/2026
8.8.x 12/2021 12/2021 6/2023 6/2025
8.7.x 11/2021 11/2021 5/2023 5/2025
Table 2. Server Software in Status: Extended Support
Release GA Enter Standard Enter Extended Enter End of Life
8.6.x 2/2021 2/2021 8/2022 8/2024
8.5.x 9/2020 9/2020 2/2022 2/2024