Default schedule
Out of the box, the agent runs once per hour. For most infrastructure teams that’s the right cadence and you don’t need to change it. If you do, the schedule settings live in the Luumen UI under your workspace settings.What you can configure
The schedule UI exposes three controls:- Interval — how often the agent runs (e.g., every hour, every 4 hours, daily).
- Anchor time — the time of day (UTC) the schedule is anchored to. Subsequent runs fire at the anchor plus N intervals.
- Polling interval — how often the agent checks the API for control messages between scheduled runs. The default (a few seconds) is appropriate for almost everyone.
How fresh is the data in the UI?
Compliance checks are evaluated against the most recent data the agent has reported. If you change a check or assign it to a new group, the result for each host updates on the next agent run — not immediately. For an hourly schedule that means a worst case of about an hour from edit to visible result. If you need to verify a change sooner, run the agent manually on the Patch server in addition to its schedule:Log retention
Local logs on the Patch server are pruned automatically afterlog_retention_days (default: 30). This is set locally on the agent — see Agent configuration. It’s independent of the schedule.
Picking an interval
There’s no single right answer, but a few rules of thumb:- Hourly is the right default for most infrastructure teams. It’s frequent enough that drift is caught the same shift, without generating excess load.
- Sub-hourly intervals rarely buy much. The data Luumen collects (OS version, packages, installed software, hardware) doesn’t change minute-to-minute. Faster runs mainly help during onboarding when you’re iterating on checks.
- Daily intervals are appropriate when your network is constrained or when most checks are baseline configuration that genuinely doesn’t change often.