SentinelOne Agent Citrix PVS Target Devices Write-Cache filled quickly

[Björn Schläfli]

We are in the process of evaluating SentinelOne Agent. I've installed this agent with parameter /vdi in the master image of my Citrix Virtual Desktops. After around 1 hour most of the time the vdiskdif.vhdx is quickly filling up. I use 4 GB RAM cache with overflow and 12 GB RAM per machine. Procmon shows a lot of writes to vdisk C:\, but I cannot find any large new files created. vdiskdif.vhdx is filled up to 15 GB after 1 day. 

Does anyone have best practices for configuring Sentinel Agent for Citrix PVS? I was unable to find some deep dive information about it. 

[Sjoerd Van den Nieuwenhof]

Hi,

 

We are using MCS, but also with a vdiskdif.vhdx, I don't see this issue. 

look at your policy for the machines within the management console of SentinelOne.

 

Think your issue has something todo with:

 

1. Snapshots
2. Scan New Agents
3. Logging

 

Below is our policy:

 

Hope this helps.

 

 

[Björn Schläfli]

Hello sjoerd,

 

thank you very much. the activated logging setting was the cause. Thank you.