# Timers & Intervals
**Audience:** IT admins. This page lists **all timers and intervals** used in Keeper Privilege Manager: job scheduling, policy refresh, KeeperAgent, KeeperClient, logging, plugin health, session monitoring, watchdog, and internal plugin loops. For each timer you will find the **value**, **how to change it** (if configurable), and the **purpose**. *** ### Overview Timers and intervals control how often the product: * Runs scheduled jobs, syncs policies, and checks for approvals * Monitors plugin and service health, user sessions, and logon/logoff * Refreshes the tray menu, flushes logs to disk, and runs internal health checks Defaults and configuration locations below apply to the current product; exact keys may vary slightly by version. Where a timer is **fixed in code**, only a product update can change it. *** ### 1. Job Scheduling
TimerValueHow to changePurpose
Job scheduler tick1 minuteFixed in code.The job service evaluates all jobs with a schedule (interval, cron, calendar) every minute. Timer- and cron-based jobs run when the current time matches their schedule.
Process Configuration Policies – minimum interval60 secondsFixed in code.The Process Configuration Policies job cannot run again until at least 60 seconds after the previous run completed. Prevents thrashing when multiple triggers fire.
Per-job schedule (interval)Varies by jobEdit the job JSON: schedule.intervalMinutes (or cron, runAt, calendar). See Jobs: definition & format.How often a specific job runs. Examples: ephemeral-account-cleanup-if-unused often uses 0.5 min (30 s); ephemeral-orphan-profile-folders-cleanup often uses 5 min (Windows only); translations may use 1440 min (24 h) or run on event.
*** ### 2. Policy Refresh and Sync | Timer | Value | How to change | Purpose | | ---------------------------------------- | ------------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Policy sync (CheckForPolicyData)** | **10 minutes** (default) | KeeperApi plugin setting **SyncFrequency** (or **sync.interval\_minutes** in plugin metadata). Set via dashboard, plugin JSON (`Plugins/KeeperApi.json`), or `PUT /api/PluginSettings/KeeperApi/...`. Value in **minutes**; some builds support `demo` = 10 s for testing. | How often the agent requests policy and job data from the backend. New or updated policies and jobs are pulled on this interval (or when sync is triggered manually, e.g. re-register or restart). | | **KeeperApi – resend pending inventory** | **30 minutes** | Fixed in code. | How often KeeperApi forces a resend of pending inventory to the backend when needed. | | **Approval list refresh (keeperAgent)** | Same as policy sync (default 10 min) | Same as **Policy sync** above. | Approval requests are updated when KeeperApi runs sync-down (same interval as policy sync). keeperAgent also refreshes when the user opens the approvals view or after approve/deny. | *** ### 3. KeeperAgent | Timer | Value | How to change | Purpose | | ------------------- | ------------------------------------ | ------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | | **Approval list** | Same as policy sync (default 10 min) | Change **SyncFrequency** for KeeperApi (see Policy refresh). | New approval requests appear after the next sync-down; user can open approvals view or trigger reload for immediate update. | | **MQTT loop delay** | **5 seconds** | Fixed in code. | Delay between iterations of the main MQTT/connection loop. Connection health is logged roughly every \~5 iterations (\~25 s). | *** ### 4. KeeperClient | Timer | Value | How to change | Purpose | | --------------------------- | ----------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **KPM health check** | **30 seconds** | Set when KeeperClient is built (constructor). Not in appsettings or plugin JSON in standard builds. | How often KeeperClient calls the KeeperPrivilegeManager `/health` endpoint to see if the service is up. Affects how quickly the tray shows “service down” after KPM stops. | | **Menu / launcher refresh** | **5 minutes** (default) | KeeperClient plugin setting **metadata.menu.refreshIntervalMinutes**. Set in `Plugins/KeeperClient.json` or via PluginSettings API. **metadata.menu.autoRefresh** must be true for the timer to run. | How often the tray menu is reloaded from the API (new jobs, launchers, menu items). | *** ### 5. Logging (KeeperLogger) | Timer | Value | How to change | Purpose | | -------------------------------- | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | | **Flush to disk** | **5 seconds** | Fixed in code. | How often buffered log messages are written to the log file. Keeps logs reasonably up to date while batching writes. | | **Connection health log** | **5 minutes** | Fixed in code. | How often the Logger plugin logs connection/health status. | | **KPM process check (shutdown)** | **500 ms** | Fixed in code. | How often the Logger checks whether the KeeperPrivilegeManager process is still running; used to decide when to shut down if the host is gone. | | **Log rotation / retention** | Configurable (e.g. size MB, days) | Logger plugin settings (e.g. **maxFileSizeMB**, **logRetentionDays**). See [Plugin and task settings](https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/reference/plugin-and-task-settings) and [Reading the log file](https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/reference/reading-logs). | When to rotate the log file (by size or date) and how long to keep old files. These are thresholds, not a periodic timer. | *** ### 6. Plugin Health Monitoring (host) | Timer | Value | How to change | Purpose | | --------------------------------- | ---------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | **Plugin health check interval** | **0.5 minutes** (30 s) | **appsettings.json**: **PluginMonitoring:CheckIntervalMinutes**. Minimum effective value in code is 0.1. | How often the main service checks whether each plugin process is still running. Used for health reporting and optional auto-restart. | | **Plugin health – initial delay** | **60 seconds** | Fixed in code. | Delay before the first health check runs after the service starts. | *** ### 7. Session Monitoring | Timer | Value | How to change | Purpose | | ---------------------------- | ------------- | --------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Session polling interval** | **5 seconds** | **appsettings.json**: **SessionMonitoring:PollingIntervalSeconds**. Minimum 1 second in code. | How often the service polls for session changes (logon, logoff, RDP connect/disconnect). Affects how quickly StartKeeperClient or session-based jobs run after a user logs on or reconnects. | *** ### 8. Watchdog (standalone process) | Timer | Value | How to change | Purpose | | ------------------------- | -------------- | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | | **Health check interval** | **10 seconds** | Watchdog config: **Watchdog:CheckIntervalSec**. Clamped between 2 and 300. | How often the Watchdog probes KeeperPrivilegeManager health. After consecutive failures it may remediate (e.g. restart the service). | | **Startup delay** | **90 seconds** | Watchdog config: **Watchdog:StartupDelaySec**. | Delay before the first health check after the Watchdog starts. Gives KPM time to start before being probed. | *** ### 9. KeeperApi plugin (internal) | Timer | Value | How to change | Purpose | | ---------------------------- | ------------------------ | ----------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------- | | **Policy sync** | **10 minutes** (default) | Plugin setting **SyncFrequency** / **sync.interval\_minutes** (see Policy refresh). | Same as “Policy sync” above; drives CheckForPolicyData. | | **Resend pending inventory** | **30 minutes** | Fixed in code. | See “KeeperApi – resend pending inventory” above. | | **Connection health log** | **5 minutes** | Fixed in code. | How often KeeperApi logs connection/health status. | | **KPM process check** | **500 ms** | Fixed in code. | How often KeeperApi checks if the KeeperPrivilegeManager process is still running (for shutdown/cleanup). | *** ### 10. KeeperPolicy plugin (internal) | Timer | Value | How to change | Purpose | | ----------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | **Connection health log** | **5 minutes** | Fixed in code. | How often KeeperPolicy logs connection/health status. | | **KPM process check** | **500 ms** | Fixed in code. | How often KeeperPolicy checks if the host process is still running (for shutdown). | | **Policy evaluation timeout** | **30 seconds** (default) | KeeperPolicy plugin setting **customfilter.timeout\_seconds** (or evaluation timeout if documented). See [Plugin and task settings](https://docs.keeper.io/en/keeperpam/endpoint-privilege-manager/reference/plugin-and-task-settings). | Timeout for policy evaluation (e.g. HTTP calls to custom filter jobs). Not a periodic timer but a per-request limit. | *** ### 11. File Access and Execution Grants | Timer / value | Value | How to change | Purpose | | ---------------------------------------- | ------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | | **File access grant duration (default)** | **240 minutes** (4 hours) | Default in code. Can be overridden **per request** via **DurationMinutes** in the file access grant request (API or job). | Default time until a file access grant expires. Individual requests can request a different duration. | | **Execution grant duration (default)** | **240 minutes** (4 hours) | Default in code. Can be overridden **per request** via **DurationMinutes** in the execution grant request. | Default time until an execution grant expires. | | **ApplyFileAccessPolicies job** | Per job schedule | Job definition: `schedule.intervalMinutes` or cron/event. | How often file access policies are applied (e.g. from backend). Not a host-level timer; defined in the job JSON. | *** ### 12. Other Fixed or Code-Level Intervals | Component | Value | Purpose | | ----------------------------------------------------- | ------------------------ | ----------------------------------------------------------------------------- | | **KeeperLogger – flush to disk** | 5 s | See Logging section. | | **KeeperPolicy / KeeperApi / Logger – health log** | 5 min | Periodic connection/health log. | | **KeeperPolicy / KeeperApi / Logger – process check** | 500 ms | Detect when KPM process is gone. | | **keeperAgent – MQTT loop delay** | 5 s | Main loop pacing. | | **Elevation / ephemeral request timeout** | Per endpoint (e.g. 30 s) | Time limit for elevation or ephemeral launch requests; not a recurring timer. | *** ### Where to Configure | What | Where | | --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------ | | **PluginMonitoring** (health check interval) | **appsettings.json** → `PluginMonitoring:CheckIntervalMinutes` (default 0.5). | | **SessionMonitoring** (session poll interval) | **appsettings.json** → `SessionMonitoring:PollingIntervalSeconds` (default 5). | | **Watchdog** (check interval, startup delay) | Watchdog appsettings / config → `Watchdog:CheckIntervalSec`, `Watchdog:StartupDelaySec`. | | **Policy sync (SyncFrequency)** | KeeperApi plugin: **Plugins/KeeperApi.json** or **PUT /api/PluginSettings/KeeperApi/...** (e.g. `sync.interval_minutes` or SyncFrequency). | | **KeeperClient menu refresh** | KeeperClient plugin: **metadata.menu.refreshIntervalMinutes** (default 5), **metadata.menu.autoRefresh** (true). | | **Job schedule** | Each job’s JSON in **Jobs/** → `schedule.intervalMinutes`, `schedule.cronExpression`, etc. | | **Logger rotation/retention** | KeeperLogger plugin settings (e.g. **maxFileSizeMB**, **logRetentionDays**). | *** ### Summary Table (quick scan) | Area | Timer | Default | Configurable? | | -------------------- | ------------------------------------------- | ------------------- | ----------------------------- | | Jobs | Scheduler tick | 1 min | No (fixed) | | Jobs | Per-job interval | Per job | Yes (job JSON) | | Policy | Policy sync | 10 min | Yes (KeeperApi SyncFrequency) | | Policy | Process Configuration Policies min interval | 60 s | No (fixed) | | KeeperAgent | Approval list | Same as policy sync | Yes (same as sync) | | KeeperAgent | MQTT loop delay | 5 s | No (fixed) | | KeeperClient | KPM health | 30 s | Build-time only | | KeeperClient | Menu refresh | 5 min | Yes (metadata.menu) | | Logging | Flush to disk | 5 s | No (fixed) | | Logging | Health log | 5 min | No (fixed) | | Host | Plugin health check | 0.5 min | Yes (appsettings) | | Host | Session polling | 5 s | Yes (appsettings) | | Watchdog | Health check | 10 s | Yes (Watchdog config) | | Watchdog | Startup delay | 90 s | Yes (Watchdog config) | | KeeperApi | Resend pending inventory | 30 min | No (fixed) | | File/execution grant | Default grant duration | 240 min | Per-request override only |