L&G: Why does rule pre-processing take place when rules are not scheduled
Originally Published: 2015-06-24
Article Number
Applies To
RSA Product/Service Type: All
RSA Version/Condition: All
Issue
Cause
The reason for this behavior is that rules are based on the last incremental change that occurred. Every rule has what is called a "watch." The watch is responsible for tracking the latest changes so that when/if a rule is run, the information is up-to-date. Rules pre-processing is run after collections so that the watch is up-to-date and ready should the rule actually need to be run.
EXAMPLE:
1. Run the IDC
Status: User A is in Dept A in L&G
2. Move User A to Dept Q in the data source
Status: User A is still in Dept A in L&G
3. Create an attribute change rule to "perform a particular action whenever the department variable changes."
4. Run the IDC
Rule pre-processing runs
Status: User A is now in Dept Q in L&G
The watch sees User A has moved to Dept Q and is ready to report this change (from Dept A to Dept Q) should the rule be run.
5. Move User A to Dept Z in the data source
Status: User A is still in Dept Q in L&G
6. Run the IDC
Rule pre-processing runs
Status: User A is now in Dept Z in L&G
The watch sees User A has moved to Dept Z and is ready to report this change (from Dept Q to Z) should the rule be run
7. Run the rule
Rule pre-processing runs
Rule processing runs and looks for users who have changed departments since the last collection.
Because rule pre-processing has taken place after every collection, a watch has been opened that tracks rule changes so that if and when the rule is run, the system is prepared to report on the most up-to-date rule changes. In this case, the watch knows that User A has moved from Dept Q to Dept Z and is able to report this change.
NOTE: Enabling rules has an expected performance hit on the system. That is why we ask that no one turn on the rules module unless it is going to be used.
Notes
performance
