MARS - rule lag

[mmorris11]

I created a rule and renamed it and then incativated it; Yesterday morning. I am not only still seeing new incidents on this inactive rule, the email notifications that are set up on this rule still reflect the original name of the rule. Is there something under the hood that isn't refreshing on MARS?

[jwalker]

I experienced the same issues on my MARS boxes. It definitely appears that there is a large (sometimes up to 1 day) lag on rule changes. I would say to give it a day before you pull your hair out...

[mmorris11]

That's about what I have observed. Holy cow! I opened a TAC case on it. They are duplicating now. I'll let you know.

[mmorris11]

I STILL had this rule firing when I came in this am. I rebooted the appliance and all is well. I don't care for the idea of having to reboot the MARS every time I do rule work. No word back from TAC yet.

[mhellman]

Did you click "activate" after making the changes?

[mmorris11]

No. Based on the definition of that control it should have no effect but I'll try it. In the meantime my workaround is to issue pnstop and pnstart from the CLI. The rule changes always take effect immediately. TAC responded back with:

Hi Mike,

I'm still trying to recreate this with our developers.

We had some success and failures.

We are trying to find the reason for this behavior.

I will let you know as soon as we find out.

For the temporary workaround, please create a new report instead of modifying the existing report.

Thank you for your patience.

Edward

I don't think he really gets the problem at all because if the rule changes are not taking effect it doesn't matter how many times you run a new report on it. It still reports according to how it thinks it is set up.

-mike

[mhellman · Accepted solution]

IME, rule changes have always required clicking the "activate" button. The documentation, which is admittedly not so good, states this in a few places.

[mmorris11]

Looks like your right. Thanks.