This metric records kernel handles usage from the sensor service. This metric does not include GDI (Graphics Device Interface) or user handles. Sensors that are running on Windows XP x86 do not report this metric.
Cause
Carbon Black EDR sensor service kernel handle usage is above normal values.
Severity Scale
| Handles |
Health score |
Message |
|---|---|---|
| > 500 |
-5 |
Elevated handle count |
| > 1000 |
-10 |
High handle count |
| > 2000 |
-25 |
Very high handle count |
| > 4000 |
-50 |
Excessive handle count |
Remediation
Analyze event collection to see if a specific event type is generating an excessive count. If these are non-binary file writes, this collection type can be often be turned off. See https://community.carbonblack.com/t5/Knowledge-Base/Turning-off-event-collection-of-Non-Binary-file-writes/ta-p/45819.
