ModulesRecentCacheTimeoutMultiplier

This parameter sets a multiplier that is used in combination with ModulesCacheWritePeriodSecs to determine how long the cache of recently observed md5 values are held in memory. For example, if the defaults are used, the timeout is 4x30=120 seconds.

Default: 4

A cache of recently observed md5 values is kept in case a partition rolls over, so that Carbon Black EDR can send the recently seen values to the new partition to make sure that nothing was missed. This cache is only restricted by time and is a multiple of the write frequency. The two parameters allow you to choose between memory limits and time limits for controlling the cache.

Note: Large timeout values can have a detrimental impact on memory.

Note: New in version 6.1.