No. UDP is primarily a notification mechanism that informs the client that new content is available. The typical action processing flow is:
UDP Notification → Content Gathering → Relevance/Condition Evaluation → Downloads (if required) → Action Execution (Start Time)
Yes. If the BESClient is busy processing other evaluations or activities, gathering and processing new actions may be delayed. There are several BESClient settings that control evaluation behavior and responsiveness, which can be reviewed and tuned if necessary.
No, analyses configured to evaluate once a day are evaluated based on an interval, not at a fixed clock time such as midnight. There is no setting to specify an exact evaluation time.
The actual evaluation depends on the client's evaluation cycle and workload. For example, a 24-hour evaluation interval might extend to 25 hours or longer if the client is busy.
I would suggest first reviewing the affected actions to ensure there are no execution time restrictions, scheduling conditions, or other constraints causing the delay.
If everything looks fine, check the BESClient logs for frequent GatherHashMV entries, which can indicate that the client is receiving UDP notifications and initiating content gathering. However, this alone does not confirm that every notification is being received successfully.
If UDP communication is working and there are no action constraints, I would recommend enabling the following on one affected endpoint:
-
BESClient debug logging
-
BESClient Usage Profiler
These should provide better visibility into what the client is doing during the affected period.
Sometimes, poorly written relevance expressions, faulty custom content, or expensive evaluations can consume significant client processing time and delay other activities. I've seen cases where a problematic relevance expression takes an unusually long time (sometime hours) to evaluate and impacts overall client responsiveness.
The Usage Profiler should help identify such expensive evaluations, while debug logging can help narrow down where the delay is occurring.
If the clients are eventually receiving and executing the actions, I would largely rule out permission-related issues.
Another thing I would suggest is reviewing the BESClient settings, particularly quiet hours, power-related settings, or any other restrictions that might delay action execution.
Also, check whether the affected devices are powered on and reachable throughout the day or only during their operational hours. This is especially worth checking for cloud-hosted devices, which are sometimes scheduled to shut down outside business hours.
Yes, that's normal to some extent and generally not a concern. The Action Issued Time does not mean the action will start at the same time on every endpoint. As highlighted earlier, action execution depends on several factors, including client workload, evaluation cycles, content gathering, downloads, and execution constraints.
However, if the delay is unusually long or consistently occurs during a specific time window, it's worth investigating rather than simply ignoring it.