SentinelOne Agent (SentinelAgent.exe) Excessive RAM Usage Linked to Low Free Disk Space and Large Internal Database Footprint

ControlUp has identified excessive memory consumption by the SentinelOne Agent, specifically SentinelAgent.exe, across multiple environments.

In affected cases, the process consumed substantially more memory than SentinelOne’s published guidance of approximately 2 GB. The pattern has been observed across a growing number of organizations and appears to be associated with devices experiencing both elevated SentinelAgent.exe memory use and low available disk space.

This behavior has been observed across more than 70 organizations and is classified as medium severity.

On affected Windows 11 devices, SentinelAgent.exe has been observed consuming 10 GB or more of RAM. In some cases, the process consumed the majority of available memory on the device.

Unlike a server performing sustained, high-volume workloads, a large memory footprint on a user endpoint can create substantial performance issues. Affected devices may experience:

• Reduced available memory for user applications
• Slower application launches and degraded responsiveness
• Increased paging activity
• General endpoint slowness or instability
• A poorer digital employee experience, especially on devices with limited RAM

Analysis of affected devices identified a significant correlation between excessive SentinelAgent.exe memory consumption and extremely low available disk space.

Further investigation showed that the SentinelOne internal database, typically located in C:\ProgramData\Sentinel, can consume significant storage capacity. In some cases, the database footprint reached 80 GB or more.

The working hypothesis is that low available disk space may contribute to increased agent memory consumption because the agent is unable to flush or manage data efficiently on disk.

Organizations experiencing this behavior should:

• Review free disk space on affected endpoints
• Review the size of the SentinelOne database under C:\ProgramData\Sentinel
• Avoid manually deleting SentinelOne database content while agent services are active
• Use the Purge DB command from the SentinelOne Management Console to reduce the database footprint
• Reboot affected devices after the database purge, where necessary, to allow the SentinelAgent.exe memory footprint to return to an acceptable baseline
• Monitor memory usage and available disk space after remediation

Any remediation should be tested through normal operational processes before broad deployment.

This finding demonstrates how endpoint resource issues can compound. In this case, excessive disk consumption and excessive RAM consumption may be related, turning a storage issue into a broader endpoint-performance problem.

ControlUp will continue monitoring this pattern across the anonymized global dataset. Community feedback may help validate whether database growth, disk pressure, operating system version, SentinelOne policy configuration, or agent version influences the behavior.