Security Center:Troubleshoot high disk or memory usage from anti-ransomware backups

Symptoms and cause

The backup cache directory consumes a large amount of disk space, triggering alerts or causing backup failures.

Under normal conditions, the cache is temporary: once backup data uploads to the cloud, the local cache is deleted automatically. Excessive usage occurs when:

• The backup set contains a very large number of files or very large individual files.

• The client runs abnormally and cached data is not cleaned up.

Modify backup cache settings

Change the cache location and configure cache parameters in the hbr.config file.

Prerequisites

• Administrative access to the server.

• The anti-ransomware client installation directory. See View client installation directory.

Procedure

1. If client self-protection is enabled, disable it first:

   1. Log on to the .

   2. In the left navigation pane, choose Assets > Host. In the upper-left corner, select the region where your assets reside: Chinese Mainland or Outside Chinese Mainland.

   3. On the Host Assets page, click View in the Actions column for the target server.

   4. In the Defense Status section, turn off the client self-protection toggle.

   

2. Log on to the server with administrative permissions.

3. Go to the anti-ransomware client installation directory (default: ../client) and create an hbr.config file if it does not already exist.

4. Add the cache parameters below to hbr.config and save the file.

Example `hbr.config`

disable_blob_cache = false
max_blob_cache_weight = 0.15
cache_prefix = D:\CacheFolder
max_retain_count = 16
disable_file_cache = false
file_cache_max_size_hint = 32GB
file_cache_disk_free_space_hint = 1GB
file_cache_max_retain_count = 2

Parameter reference

Estimating required disk space

Backing up 10 million files typically requires about 1.5 GB of cache space (actual usage varies by file count, total data size, and full path length). During a backup, one additional cache is created.

Use this formula to estimate total disk space needed:

Required disk space = 1.5 GB × (file_cache_max_retain_count + 1) + file_cache_disk_free_space_hint

For example, with the default values (file_cache_max_retain_count = 2, file_cache_disk_free_space_hint = 1 GB):

1.5 GB × (2 + 1) + 1 GB = 5.5 GB

Symptoms and cause

The backup task status is Failed and the error message shows OOM (out of memory). The hbrclient process consumes large amounts of memory while running and typically terminates after the task ends.

Common causes:

• The protected directory includes network-mounted paths (OSS or NAS mounted on an ECS instance), causing frequent data access.

• No backup network bandwidth limit is set, leading to excessive throughput.

• The server does not have enough memory for the volume of data being backed up.

Solutions

Apply one or more of the following solutions based on your situation.

Split the protected directory

Split the protected directory in your anti-ransomware policy into multiple subdirectories. Within the same policy, backup tasks run sequentially for each subdirectory — so each task covers less data and uses fewer resources.

For example, split /user/bin into multiple subdirectories. For instructions, see Manage anti-ransomware policies.

Note

Splitting the protected directory does not affect restoration of previously backed-up data. Security Center runs backup tasks for each subdirectory going forward.

Limit backup network bandwidth

Limiting throughput reduces disk, memory, and CPU usage. In the Edit Anti-ransomware Policy panel, set the Maximum Backup Network Bandwidth to a value that fits your environment. For instructions, see Manage anti-ransomware policies.

Note

Setting Maximum Backup Network Bandwidth to 0 removes all limits.

cpu_max_procs = 2

View client version

View the anti-ransomware client version on the Protection Configuration > Host Protection > Anti-ransomware page.

View client installation directory