Background jobs
What the scheduler and the queue do on their own, and when.
Scheduler
The scheduler container runs these tasks (cron expressions in UTC):
| Task | When | Does |
|---|---|---|
polaris:watchdog | every minute | marks satellites offline/online and notifies; ends one-shot jobs without progress for 2 h and scheduled runs without progress for 26 h; notifies overdue plans once |
asterion:auto-plans | every 10 minutes | rebuilds the automatic plans of every tenant (new tenants, satellites, targets) |
asterion:ct-poll | every 10 minutes | polls crt.sh for its share of the monitored domains (details) |
asterion:reports | every minute | generates and sends the reports that are due |
polaris:prune | daily 03:30 | enforces the retention of every kind of data, in small batches; also expired cache entries (one per satellite request) and fired one-time schedules older than 2 days |
privacy:prune | daily 03:40 | deletes expired sessions and password reset links |
asterion:rir-refresh | daily 04:15 | queues the refresh of registry and routing data of public IPs |
Tasks that could overlap run withoutOverlapping: a slow round is never started twice.
The exact schedule of this release, as read from the code:
| Task | Cron (UTC) | No overlap |
|---|---|---|
asterion:auto-plans | */10 * * * * | yes |
polaris:watchdog | * * * * * | yes |
polaris:prune | 30 3 * * * | |
privacy:prune | 40 3 * * * | |
asterion:rir-refresh | 15 4 * * * | |
asterion:ct-poll | */10 * * * * | yes |
asterion:reports | * * * * * | yes |
Queue
The queue container works off:
SendNotification— one notification to one channel,GenerateReport— builds the files of a report, stores them in the archive and mails them,EnrichIp— RIPEstat and RDAP lookup of one public address.LocateSatellite— locates a satellite from the address it connects from (on registration, when the address changes, and daily).
The queue lives in the database (QUEUE_CONNECTION=database); failed jobs land in failed_jobs.
Retention
| Data | Kept | Variable |
|---|---|---|
| Satellite heartbeats | 30 days | POLARIS_RETENTION_HEARTBEATS |
| Satellite logs | 60 days | POLARIS_RETENTION_LOGS |
| Runs and their parsed results | 365 days | POLARIS_RETENTION_RESULTS |
| Raw tool output (nmap XML, …) and debug steps | 30 days | POLARIS_RETENTION_RAW |
| Change history: service events, DNS / registry / certificate changes, certificate observations, expired CT entries, resolved findings, stale network paths | 2 years | POLARIS_RETENTION_HISTORY |
| Notification log | 90 days | POLARIS_RETENTION_NOTIFICATION_LOGS |
| Failed queue jobs | 30 days | POLARIS_RETENTION_FAILED_JOBS |
| Archived reports | 7 years | POLARIS_RETENTION_REPORTS_YEARS |
| Sessions | session lifetime | — |
| Password reset links | 60 minutes | — |
The current state — hosts, services, certificates, DNS records, open findings — is kept until it is deleted. Deletion runs in batches of 1000 rows (200 runs), so large tables are never locked by one long statement.