This topic provides a brief introduction to the scheduler and explains how to schedule commands. All NetWitness Core services come with a built-in scheduler found under
. To use the scheduler, you add the command you want to run periodically using one of two messages:
- Add a command to run at the specified interval (every N hours, minutes or seconds)
- Add a command to run at the specified time of day or even specific days of the week
For example, suppose that you have a use case to delete all packet data that is greater than seven days old. Since you cannot configure the packet.dir setting to rollout data based on a time interval, you need to schedule the
command to run every so often. For this example, create a timeRoll to run every 20 minutes:
addIter minutes=20 pathname=/database msg=timeRoll params="type=packet days=7"
This command adds a scheduled task (it is persisted between restarts of the service) to run every 20 minutes, on the
node, and ages out all packet data older than seven days. The
parameter is used to pass all the parameters to the command specified (in this case
). Notice how it quotes all the embedded parameters (
) so they are not interpreted as parameters to be passed to the outer
command. If the parameters inside
need to use quotes, you must escape the inner quotes with a backslash. You can rewrite it with embedded quotes, which does not alter the command in any way:
addIter minutes="20" pathname="/database" msg="timeRoll" params="type=\"packet\" days=\"7\""
This command works identically to the original, but demonstrates how to escape complicated parameter passing. Additional useful scheduler commands are:
- Print all scheduled commands (you can also see them by doing an
on the scheduler node).
- Delete a scheduled command by passing in the identifier shown in the
This is a brief introduction to the scheduler. For more information on command parameters, send the
message to the scheduler node and pass in the command name via the
parameter. For more information, see the "Services Explore View" topic in the
Host and Services Getting Started Guide