Scheduling Rules

You can schedule rules to run at a specified time interval such as hourly, daily, or monthly.

Scheduled rules are a useful alternative to real-time rules in situations where you want to deploy rules that take into account historical data along with live data, or when you simply want to control when the rules are run. The scheduled rules engine can process historical data, take real actions, and generate correlation events which are the same as those generated by the real-time rules engine.

Best practices for scheduled rules:

• Scheduling does not apply to pre-persistence rules. If an unscheduled rule group includes pre-persistence rules, the Console prevents you from scheduling that rule group. However, scheduling is at the group level. You can still schedule a parent group even if one or more of its child groups contain pre-persistence rules.

• Use future start and end dates for your rule schedules. If you use past dates, the rule will not run because the scheduler assumes that the job is finished.

• After a scheduled job has run once, it will not run again even if you change the schedule’s start time and try to rerun it. Remove the old schedule and create a new one in this case.

• If you are interested only in historical data and you use a past start time and no end time, the rule will be in “catch up” mode. The rule will execute on all the data from the start to the current time, not only on historical data.

Topics include:

• Scenarios for Using Scheduled Rules

• Scheduling a Rule Group

• Example of a Scheduled Rule (Badge Swipes and Logins)