Risk Fabric processing job schedules

Products

• Information Centric Analytics
• Data Loss Prevention Core Package

Issue/Introduction

During installation, Information Centric Analytics (ICA) creates two SQL Server Agent jobs that are responsible for importing and processing data from data sources and processing the RiskFabric cube:

• RiskFabric Processing
  • Scheduled to run daily at 12:15 (server time) by default
• RiskFabric Intraday Processing
  • Scheduled to run daily every two hours between 11:00 and 20:00 (server time)

The RiskFabric Processing job (also referred to as the nightly job) processes data from all integrations into ICA's core tables and cube and must be enabled for full ICA functionality. The RiskFabric Intraday Processing job is optional and only processes data from Symantec DLP data sources.

Both jobs can be enabled or disabled in the ICA console under Admin > Integration > Job Status, but neither job's schedule can be modified through the console.

Environment

Version : 6.x

Component : RiskFabric Processing

Resolution

To modify the schedule of either the nightly RiskFabric Processing job or the RiskFabric Intraday Processing job, follow this procedure:

1. Open SQL Server Management Studio (SSMS)
2. Connect to the Database Engine hosting the RiskFabric database
3. In Object Explorer, navigate to SQL Server Agent > Jobs
4. Right-click the RiskFabric Processing or RiskFabric Intraday Processing job and select Properties
   The Job Properties - RiskFabric Processing or Job Properties - RiskFabric Intraday Processing window will open
5. Select the Schedules page
6. Click the Edit button
   The Job Schedule Properties - RiskFabric Schedule or Job Schedule Properties - RiskFabric Dev Intraday Scheduler window will open
7. Modify the job schedule as needed
8. Click the OK button to close the Job Schedule Properties window
9. Click the OK button to close the Job Properties window

NOTE: Ensure the schedules of these two jobs do not overlap. By design, both jobs first determine whether the other job is currently running and will fail if run concurrently, logging an error similar to the following:

Error Msg: Previous Nightly job <job-step> is still running

Additional Information

The following KB articles explain some of the differences between the data processed during the nightly and intraday RiskFabric processing jobs:

Analyzer dimensions and measures updated during processing
https://knowledge.broadcom.com/external/article?articleId=236987

Events dashboards are not updated by the intraday job
https://knowledge.broadcom.com/external/article?articleId=195850