|Applies To||RSA Product Set: Security Analytics, NetWitness|
RSA Product/Service Type: Concentrator
RSA Version/Condition: 9.8.x, 10.3.x, 10.4.x, 10.5.x
O/S Version: EL5, EL6
|Issue||A user wishes to initiate index save operation at a specific time rather than the default of every 8 hours.|
|Tasks||Use the steps outlined in this article to set one or more specific times to run the index save operations. |
|Notes||You must enter a separate line for each specific time you wish to save an index slice.|
For example, to run the index save operation at 1:00:00, 9:00:00 and 17:00:00 enter the following three lines in the scheduler:
time=1:00:00 pathname=/index msg=save
If you only enter one time, it will be the functional equivalent of setting "hours=24" and will run once per day at that specified time.
You may not use both an interval and specific time in the configuration file concurrently. That is, you may not specific an "hours=x" and a "time=HH:MM:SS" in the scheduler simultaneously.
Generally you will be warned if you make a syntactical error. However, some invalid entries may not be properly validated and may prevent you from successfully restarting the Concentrator service.