Analyst Interval Start Time

[ChrisMiller]

I have an analyst with three rules. One rule runs ever hour, one every two hours and the last every four hours.  I have the rules disabled by default and will enable them as needed to run a tacl macro.  I'm trying to understand when the rule will start once enabled.  Talking strictly about the rule running on a four hour interval, once it started at the top of the next hour and another time it waited more than four hours before running.  Here are some times to help.

09:14 - started the four hour rule

10:00 - rule ran (46 mins later)

13:00 - rule ran

... next day

07:28 - stopped and started the rule

12:00 - rule ran (4:32 later)

14:07 - stopped and started rule

15:00 - rule ran (53 mins later)

18:35 - stopped and started rule

23:00 - rule ran (4:25 hrs later)

Best I can tell, if I start the rule before 15 minutes into the hour, the rule runs at the next hour.  If later it waits 4+ hours to run.  Can someone confirm this is the case?

Thanks, Chris

[Leon_Arens]

If you have rules that have the EVERY x hours, then I believe the analyst defaults to a REFRESH of 4 hours.

To get a rule to trigger when you start them from the GUI I believe you need to add a REFRESH value smaller than the EVERY value

i.e.

    REFRESH 1 minute
    EVERY   4 hours

[ChrisMiller]

Thanks Leon.  

Following your response I realized I only had REFRESH listed and not EVERY.  I have now added an EVERY clause to the rules with the desired interval and changed the REFRESH to 60 minutes for each.  This has so far resulted in the desired behavior, which is for the rule to start at the top of the next hour then run at the specific interval thereafter.

I'm still curious why it behaved one way when started early in the hour versus later in the hour.  But I guess not curious enough to open a case.

Thanks again.