Timers & Intervals
Audience: IT admins. This page lists all timers and intervals used in Keeper Privilege Manager: job scheduling, policy refresh, KeeperAgent, KeeperClient, logging, plugin health, session monitoring, watchdog, and internal plugin loops. For each timer you will find the value, how to change it (if configurable), and the purpose.
Overview
Timers and intervals control how often the product:
Runs scheduled jobs, syncs policies, and checks for approvals
Monitors plugin and service health, user sessions, and logon/logoff
Refreshes the tray menu, flushes logs to disk, and runs internal health checks
Defaults and configuration locations below apply to the current product; exact keys may vary slightly by version. Where a timer is fixed in code, only a product update can change it.
1. Job Scheduling
Job scheduler tick
1 minute
Fixed in code.
The job service evaluates all jobs with a schedule (interval, cron, calendar) every minute. Timer- and cron-based jobs run when the current time matches their schedule.
Process Configuration Policies – minimum interval
60 seconds
Fixed in code.
The Process Configuration Policies job cannot run again until at least 60 seconds after the previous run completed. Prevents thrashing when multiple triggers fire.
Per-job schedule (interval)
Varies by job
Edit the job JSON: schedule.intervalMinutes (or cron, runAt, calendar). See Jobs: definition & format.
How often a specific job runs. Examples: ephemeral-account-cleanup-if-unused often uses 0.5 min (30 s); ephemeral-orphan-profile-folders-cleanup often uses 5 min (Windows only); translations may use 1440 min (24 h) or run on event.
2. Policy Refresh and Sync
Policy sync (CheckForPolicyData)
10 minutes (default)
KeeperApi plugin setting SyncFrequency (or sync.interval_minutes in plugin metadata). Set via dashboard, plugin JSON (Plugins/KeeperApi.json), or PUT /api/PluginSettings/KeeperApi/.... Value in minutes; some builds support demo = 10 s for testing.
How often the agent requests policy and job data from the backend. New or updated policies and jobs are pulled on this interval (or when sync is triggered manually, e.g. re-register or restart).
KeeperApi – resend pending inventory
30 minutes
Fixed in code.
How often KeeperApi forces a resend of pending inventory to the backend when needed.
Approval list refresh (keeperAgent)
Same as policy sync (default 10 min)
Same as Policy sync above.
Approval requests are updated when KeeperApi runs sync-down (same interval as policy sync). keeperAgent also refreshes when the user opens the approvals view or after approve/deny.
3. KeeperAgent
Approval list
Same as policy sync (default 10 min)
Change SyncFrequency for KeeperApi (see Policy refresh).
New approval requests appear after the next sync-down; user can open approvals view or trigger reload for immediate update.
MQTT loop delay
5 seconds
Fixed in code.
Delay between iterations of the main MQTT/connection loop. Connection health is logged roughly every ~5 iterations (~25 s).
4. KeeperClient
KPM health check
30 seconds
Set when KeeperClient is built (constructor). Not in appsettings or plugin JSON in standard builds.
How often KeeperClient calls the KeeperPrivilegeManager /health endpoint to see if the service is up. Affects how quickly the tray shows “service down” after KPM stops.
Menu / launcher refresh
5 minutes (default)
KeeperClient plugin setting metadata.menu.refreshIntervalMinutes. Set in Plugins/KeeperClient.json or via PluginSettings API. metadata.menu.autoRefresh must be true for the timer to run.
How often the tray menu is reloaded from the API (new jobs, launchers, menu items).
5. Logging (KeeperLogger)
Flush to disk
5 seconds
Fixed in code.
How often buffered log messages are written to the log file. Keeps logs reasonably up to date while batching writes.
Connection health log
5 minutes
Fixed in code.
How often the Logger plugin logs connection/health status.
KPM process check (shutdown)
500 ms
Fixed in code.
How often the Logger checks whether the KeeperPrivilegeManager process is still running; used to decide when to shut down if the host is gone.
Log rotation / retention
Configurable (e.g. size MB, days)
Logger plugin settings (e.g. maxFileSizeMB, logRetentionDays). See Plugin and task settings and Reading the log file.
When to rotate the log file (by size or date) and how long to keep old files. These are thresholds, not a periodic timer.
6. Plugin Health Monitoring (host)
Plugin health check interval
0.5 minutes (30 s)
appsettings.json: PluginMonitoring:CheckIntervalMinutes. Minimum effective value in code is 0.1.
How often the main service checks whether each plugin process is still running. Used for health reporting and optional auto-restart.
Plugin health – initial delay
60 seconds
Fixed in code.
Delay before the first health check runs after the service starts.
7. Session Monitoring
Session polling interval
5 seconds
appsettings.json: SessionMonitoring:PollingIntervalSeconds. Minimum 1 second in code.
How often the service polls for session changes (logon, logoff, RDP connect/disconnect). Affects how quickly StartKeeperClient or session-based jobs run after a user logs on or reconnects.
8. Watchdog (standalone process)
Health check interval
10 seconds
Watchdog config: Watchdog:CheckIntervalSec. Clamped between 2 and 300.
How often the Watchdog probes KeeperPrivilegeManager health. After consecutive failures it may remediate (e.g. restart the service).
Startup delay
90 seconds
Watchdog config: Watchdog:StartupDelaySec.
Delay before the first health check after the Watchdog starts. Gives KPM time to start before being probed.
9. KeeperApi plugin (internal)
Policy sync
10 minutes (default)
Plugin setting SyncFrequency / sync.interval_minutes (see Policy refresh).
Same as “Policy sync” above; drives CheckForPolicyData.
Resend pending inventory
30 minutes
Fixed in code.
See “KeeperApi – resend pending inventory” above.
Connection health log
5 minutes
Fixed in code.
How often KeeperApi logs connection/health status.
KPM process check
500 ms
Fixed in code.
How often KeeperApi checks if the KeeperPrivilegeManager process is still running (for shutdown/cleanup).
10. KeeperPolicy plugin (internal)
Connection health log
5 minutes
Fixed in code.
How often KeeperPolicy logs connection/health status.
KPM process check
500 ms
Fixed in code.
How often KeeperPolicy checks if the host process is still running (for shutdown).
Policy evaluation timeout
30 seconds (default)
KeeperPolicy plugin setting customfilter.timeout_seconds (or evaluation timeout if documented). See Plugin and task settings.
Timeout for policy evaluation (e.g. HTTP calls to custom filter jobs). Not a periodic timer but a per-request limit.
11. File Access and Execution Grants
File access grant duration (default)
240 minutes (4 hours)
Default in code. Can be overridden per request via DurationMinutes in the file access grant request (API or job).
Default time until a file access grant expires. Individual requests can request a different duration.
Execution grant duration (default)
240 minutes (4 hours)
Default in code. Can be overridden per request via DurationMinutes in the execution grant request.
Default time until an execution grant expires.
ApplyFileAccessPolicies job
Per job schedule
Job definition: schedule.intervalMinutes or cron/event.
How often file access policies are applied (e.g. from backend). Not a host-level timer; defined in the job JSON.
12. Other Fixed or Code-Level Intervals
KeeperLogger – flush to disk
5 s
See Logging section.
KeeperPolicy / KeeperApi / Logger – health log
5 min
Periodic connection/health log.
KeeperPolicy / KeeperApi / Logger – process check
500 ms
Detect when KPM process is gone.
keeperAgent – MQTT loop delay
5 s
Main loop pacing.
Elevation / ephemeral request timeout
Per endpoint (e.g. 30 s)
Time limit for elevation or ephemeral launch requests; not a recurring timer.
Where to Configure
PluginMonitoring (health check interval)
appsettings.json → PluginMonitoring:CheckIntervalMinutes (default 0.5).
SessionMonitoring (session poll interval)
appsettings.json → SessionMonitoring:PollingIntervalSeconds (default 5).
Watchdog (check interval, startup delay)
Watchdog appsettings / config → Watchdog:CheckIntervalSec, Watchdog:StartupDelaySec.
Policy sync (SyncFrequency)
KeeperApi plugin: Plugins/KeeperApi.json or PUT /api/PluginSettings/KeeperApi/... (e.g. sync.interval_minutes or SyncFrequency).
KeeperClient menu refresh
KeeperClient plugin: metadata.menu.refreshIntervalMinutes (default 5), metadata.menu.autoRefresh (true).
Job schedule
Each job’s JSON in Jobs/ → schedule.intervalMinutes, schedule.cronExpression, etc.
Logger rotation/retention
KeeperLogger plugin settings (e.g. maxFileSizeMB, logRetentionDays).
Summary Table (quick scan)
Jobs
Scheduler tick
1 min
No (fixed)
Jobs
Per-job interval
Per job
Yes (job JSON)
Policy
Policy sync
10 min
Yes (KeeperApi SyncFrequency)
Policy
Process Configuration Policies min interval
60 s
No (fixed)
KeeperAgent
Approval list
Same as policy sync
Yes (same as sync)
KeeperAgent
MQTT loop delay
5 s
No (fixed)
KeeperClient
KPM health
30 s
Build-time only
KeeperClient
Menu refresh
5 min
Yes (metadata.menu)
Logging
Flush to disk
5 s
No (fixed)
Logging
Health log
5 min
No (fixed)
Host
Plugin health check
0.5 min
Yes (appsettings)
Host
Session polling
5 s
Yes (appsettings)
Watchdog
Health check
10 s
Yes (Watchdog config)
Watchdog
Startup delay
90 s
Yes (Watchdog config)
KeeperApi
Resend pending inventory
30 min
No (fixed)
File/execution grant
Default grant duration
240 min
Per-request override only
Return to Reference Index
Last updated
Was this helpful?