# Timers & Intervals

<figure><img src="/files/DRhY4RbW7nVaSrNPIN98" alt=""><figcaption></figcaption></figure>

**Audience:** IT admins. This page lists **all timers and intervals** used in Keeper Privilege Manager: job scheduling, policy refresh, KeeperAgent, KeeperClient, logging, plugin health, session monitoring, watchdog, and internal plugin loops. For each timer you will find the **value**, **how to change it** (if configurable), and the **purpose**.

***

Keeper EPM uses a set of timers and intervals to control when it syncs policies, runs jobs, checks health, monitors sessions, refreshes the user interface, and manages time-limited grants. This page is a single reference for all of them — what each timer does, its default value, and whether (and how) you can change it.

{% hint style="info" icon="right-left" %}
**Fixed vs. configurable:** Some timers are fixed in the product code and can only be changed by a product update. Others are configurable through settings files, plugin configuration, or the dashboard. Each section below identifies which category applies.
{% endhint %}

## Quick Reference

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Area</th><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td>Jobs</td><td>Scheduler tick</td><td>1 min</td><td>No</td></tr><tr><td>Jobs</td><td>Per-job interval</td><td>Varies by job</td><td>Yes — job JSON</td></tr><tr><td>Jobs</td><td>Process Config Policies min interval</td><td>60 s</td><td>No</td></tr><tr><td>Policy</td><td>Policy sync</td><td>10 min</td><td>Yes — KeeperApi <code>SyncFrequency</code></td></tr><tr><td>Policy</td><td>Resend pending inventory</td><td>30 min</td><td>No</td></tr><tr><td>KeeperAgent</td><td>Approval list refresh</td><td>Same as policy sync</td><td>Yes — same as sync</td></tr><tr><td>KeeperAgent</td><td>MQTT loop delay</td><td>5 s</td><td>No</td></tr><tr><td>KeeperClient</td><td>KPM health check</td><td>30 s</td><td>No</td></tr><tr><td>KeeperClient</td><td>Menu / launcher refresh</td><td>5 min</td><td>Yes — <code>metadata.menu</code></td></tr><tr><td>Logging</td><td>Flush to disk</td><td>5 s</td><td>No</td></tr><tr><td>Logging</td><td>Connection health log</td><td>5 min</td><td>No</td></tr><tr><td>Logging</td><td>KPM process check (shutdown)</td><td>500 ms</td><td>No</td></tr><tr><td>Plugin health</td><td>Plugin health check</td><td>30 s (0.5 min)</td><td>Yes — <code>appsettings.json</code></td></tr><tr><td>Plugin health</td><td>Initial delay before first check</td><td>60 s</td><td>No</td></tr><tr><td>Session monitoring</td><td>Session polling</td><td>5 s</td><td>Yes — <code>appsettings.json</code></td></tr><tr><td>Watchdog</td><td>Health check interval</td><td>10 s</td><td>Yes — Watchdog config</td></tr><tr><td>Watchdog</td><td>Startup delay</td><td>90 s</td><td>Yes — Watchdog config</td></tr><tr><td>File / execution grants</td><td>Default grant duration</td><td>240 min (4 hrs)</td><td>Yes — per-request via <code>DurationMinutes</code></td></tr><tr><td>Policy evaluation</td><td>Custom filter timeout</td><td>30 s</td><td>Yes — KeeperPolicy plugin</td></tr></tbody></table>

* [Job Scheduling](#job-scheduling)
* [Policy Refresh & Sync](#policy-refresh-and-sync)
* [Keeper Agent](#keeper-agent)
* [Keeper Client](#keeper-client)
* [Logging](#logging)
* [Plugin Health Monitoring](#plugin-health-monitoring)
* [Session Monitoring](#session-monitoring)
* [Watchdog](#watchdog)
* [File Access & Execution Grants](#file-access-and-execution-grants)
* [Policy Evaluation Timeout](#policy-evaluation-timeout)

## Job Scheduling

The job service evaluates all scheduled jobs once per minute. When the current time matches a job's configured schedule, the job is queued to run.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Scheduler tick</strong></td><td>1 minute</td><td>No — fixed in code</td></tr><tr><td><strong>Process Configuration Policies – minimum interval</strong></td><td>60 seconds</td><td>No — fixed in code; prevents the configuration processor from running again immediately when multiple triggers fire at once</td></tr><tr><td><strong>Per-job schedule</strong></td><td>Varies</td><td>Yes — edit the job's JSON: <code>schedule.intervalMinutes</code>, <code>schedule.cronExpression</code>, <code>schedule.runAt</code>, or <code>schedule.calendar</code></td></tr></tbody></table>

### **Common per-job schedule examples:**

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Job</th><th>Default schedule</th></tr></thead><tbody><tr><td><code>ephemeral-account-cleanup-if-unused</code></td><td>Every 0.5 minutes (30 seconds)</td></tr><tr><td><code>ephemeral-orphan-profile-folders-cleanup</code></td><td>Every 5 minutes (Windows only)</td></tr><tr><td><code>mfa-lockout-cleanup</code></td><td>Every 1 minute</td></tr><tr><td><code>keeperagent-silent-expiration-check</code></td><td>Every 1440 minutes (24 hours)</td></tr></tbody></table>

**To configure:** Edit the job's JSON file in the `Jobs/` directory, setting `schedule.intervalMinutes` (or `schedule.cronExpression`, `schedule.runAt`, or `schedule.calendar` depending on the schedule type). Jobs can also be updated centrally across all endpoints using an **Update Jobs** policy. See [Jobs: Definition & Format](/keeperpam/endpoint-privilege-manager/reference/jobs-definition-and-format.md) for the full schedule syntax.

***

## Policy Refresh & Sync

The agent periodically checks the Keeper backend for updated policies, jobs, and approval data. This is driven by the **KeeperApi** plugin.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Policy sync</strong></td><td>10 minutes</td><td>Yes</td></tr><tr><td><strong>Resend pending inventory</strong></td><td>30 minutes</td><td>No — fixed in code</td></tr><tr><td><strong>Approval list refresh</strong></td><td>Same as policy sync (10 min default)</td><td>Yes — controlled by the same setting as policy sync</td></tr></tbody></table>

**How approvals are updated:** Approval data is not on a separate timer. It is updated as part of the same sync-down cycle that pulls new policies. The Keeper Agent also refreshes its approval list automatically when a user opens the approvals view, or after an approver grants or denies a request.

**To configure:** Change the **`SyncFrequency`** setting (or `sync.interval_minutes`) in the KeeperApi plugin. This can be set via the dashboard, by editing `Plugins/KeeperApi.json` directly, or via `PUT /api/PluginSettings/KeeperApi/...`. The value is in minutes.

To trigger an immediate policy sync on an endpoint, use the **Refresh Policies** option in the Keeper Agent system tray menu.

***

## Keeper Agent

The Keeper Agent is the desktop application that users interact with to manage and launch their approval requests.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Approval list refresh</strong></td><td>Same as policy sync (10 min)</td><td>Yes</td></tr><tr><td><strong>MQTT loop delay</strong></td><td>5 seconds</td><td>No — fixed in code</td></tr></tbody></table>

**To configure:** The approval list refresh interval is controlled by the same `SyncFrequency` setting as policy sync — see section 2 above. The MQTT loop delay cannot be changed.

***

## Keeper Client

The Keeper Client is the system tray application that handles notifications, menu items, and user-facing actions on the endpoint.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>KPM health check</strong></td><td>30 seconds</td><td>No — set at build time</td></tr><tr><td><strong>Menu / launcher refresh</strong></td><td>5 minutes</td><td>Yes</td></tr></tbody></table>

The **KPM health check** controls how quickly the system tray icon reflects that the main service has gone down. The **menu refresh** controls how quickly new jobs, launchers, and menu items appear in the tray after they are deployed.

**To configure the menu refresh interval:** Set **`metadata.menu.refreshIntervalMinutes`** in the KeeperClient plugin. This can be edited in `Plugins/KeeperClient.json` or via the PluginSettings API. The setting **`metadata.menu.autoRefresh`** must be `true` for the refresh timer to run.

***

## Logging

The **KeeperLogger** plugin manages log output. Most of its internal intervals are fixed to ensure reliable, consistent behavior. Log rotation and retention thresholds are configurable.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Flush to disk</strong></td><td>5 seconds</td><td>No — fixed in code</td></tr><tr><td><strong>Connection health log</strong></td><td>5 minutes</td><td>No — fixed in code</td></tr><tr><td><strong>KPM process check (for shutdown)</strong></td><td>500 ms</td><td>No — fixed in code</td></tr><tr><td><strong>Log rotation / retention</strong></td><td>Configurable</td><td>Yes</td></tr></tbody></table>

Log rotation and retention are thresholds, not periodic timers. The logger rotates when the file reaches the configured size limit and removes old files when they exceed the configured retention period.

**To configure log rotation and retention:** Set **`maxFileSizeMB`** and **`logRetentionDays`** in the KeeperLogger plugin settings. See [Reading Logs](/keeperpam/endpoint-privilege-manager/user-guides/reading-logs.md) for details.

***

## Plugin Health Monitoring

The main service monitors each plugin process to detect crashes or unexpected exits.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Plugin health check interval</strong></td><td>30 seconds (0.5 min)</td><td>Yes</td></tr><tr><td><strong>Initial delay before first check</strong></td><td>60 seconds</td><td>No — fixed in code</td></tr></tbody></table>

The initial delay allows plugins time to start cleanly before they are first probed, preventing false-positive failure detection during service startup.

**To configure the health check interval:** Set **`PluginMonitoring:CheckIntervalMinutes`** in `appsettings.json`. The minimum effective value is 0.1 minutes (6 seconds).

***

## Session Monitoring

The service monitors user sessions to detect logons, logoffs, and Remote Desktop (RDP) connect and disconnect events. Session changes can trigger jobs — for example, starting the Keeper Client when a user logs on.

| Timer                        | Default   | Configurable? |
| ---------------------------- | --------- | ------------- |
| **Session polling interval** | 5 seconds | Yes           |

A shorter interval means session-based jobs start faster after a user logs in or reconnects over RDP.

**To configure:** Set **`SessionMonitoring:PollingIntervalSeconds`** in `appsettings.json`. The minimum value is 1 second.

***

## Watchdog

The **Watchdog** is a separate, lightweight monitoring service that runs independently of the main Keeper EPM service. It periodically probes the main service's health endpoint and can automatically restart the service if it becomes unresponsive.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>Health check interval</strong></td><td>10 seconds</td><td>Yes — clamped between 2 and 300 seconds</td></tr><tr><td><strong>Startup delay</strong></td><td>90 seconds</td><td>Yes — minimum 30 seconds</td></tr></tbody></table>

The startup delay gives the main service time to finish starting before the Watchdog begins health checks, preventing false-positive failure detection during normal startup. The Watchdog can be configured to either restart the service automatically (`AutoRemediate: true`) or only monitor and log (`AutoRemediate: false`).

**To configure:** Set **`Watchdog:CheckIntervalSec`** and **`Watchdog:StartupDelaySec`** in the Watchdog's `appsettings.json` configuration. Both settings can also be pushed centrally to endpoints using a **ConfigurationUpdate** policy. See [Plugin and Task Settings](/keeperpam/endpoint-privilege-manager/reference/plugin-and-task-settings.md) for details.

***

## File Access & Execution Grants

When a user is granted temporary access to a file or elevated execution after satisfying a control (MFA, Justification, or Approval), that access is time-limited and reverts automatically when the grant expires.

<table data-header-hidden="false" data-header-sticky><thead><tr><th>Timer / Value</th><th>Default</th><th>Configurable?</th></tr></thead><tbody><tr><td><strong>File access grant duration</strong></td><td>240 minutes (4 hours)</td><td>Yes — per request</td></tr><tr><td><strong>Execution grant duration</strong></td><td>240 minutes (4 hours)</td><td>Yes — per request</td></tr><tr><td><strong>ApplyFileAccessPolicies job schedule</strong></td><td>Per job definition</td><td>Yes — job JSON</td></tr></tbody></table>

These durations are defaults set in code. There is no global dashboard slider. Changing the default requires pushing a modified job definition to endpoints using an **Update Jobs** policy.

**To configure:** Set the **`DurationMinutes`** parameter in the `GrantFileAccess` job (for approval-gated access) or the `LaunchFileAccess` job (for MFA- or justification-gated access). See [Configuring the Approval Duration](/keeperpam/endpoint-privilege-manager/user-guides/configuring-the-approval-duration.md) for step-by-step instructions.

***

## Policy Evaluation Timeout

When a policy uses a **custom filter job**, the policy engine calls that job during evaluation and waits for a response. If the job does not respond within the timeout window, the custom filter is treated as failed.

| Timer                                | Default    | Configurable? |
| ------------------------------------ | ---------- | ------------- |
| **Custom filter evaluation timeout** | 30 seconds | Yes           |

This is a per-request timeout, not a recurring interval. If your custom filter jobs involve external API calls or slower scripts, you may need to increase this value to prevent evaluation timeouts.

**To configure:** Set **`customfilter.timeout_seconds`** in the KeeperPolicy plugin settings. See [Plugin and Task Settings](/keeperpam/endpoint-privilege-manager/reference/plugin-and-task-settings.md) for details.


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.keeper.io/keeperpam/endpoint-privilege-manager/reference/timers-and-intervals.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.