The "ExpectedTime" variable from an InTrust Monitoring rule is not retained and also the error "8320" appears in the Intrust server logs when running the rule. (4377407)

When attempting to create a monitoring rule in InTrust Manager (regardless if is for Paired Event Rules or Missing Event Rules) you get a "Cannot install InTrust Rule" error in the server logs when it tries to push to the agents. Also, the "ExpectedTime" setting in "Matching" keeps defaulting to blank after is set:

Product defect - whenever more than 4 days are selected (any day in the week from Sunday to Saturday ) then the variable is reset and also you get the error "Local\2ImmersiveFocusTrackingActiveEvent":

However, when only 4 days are selected (from Sunday to Saturday), it gets saved as expected.

Product Defect ID 5240444 was logged by the product team for review and consideration to implement a fix in a future release.

WORKAROUND:

1. Open the InTrust Manager console.

2. Create a new rule using the below steps:

Under Real-Time MonitoringàRulesàInTrust Log MonitoringàRight ClickàSelect Missing Eventà Nextà Select any Data sourcesàNextàSelect any Filter TemplatesàSelect any parameters(Optional)àNextàNextàGive Name to Rule like “Missing Log Threshold”à FinishàCommit

3. Then you will need to replace the below line in the XML script manually when clicking on the Advanced option:

<value>Local\2ImmersiveFocusTrackingActiveEvent</value>

with the below line:

<value>"0 1 * * 0,1,2,6 ","0/00/0 01:00:00"</value>

Note: You will have to enter desire values in double quotes after 0 1 * * such as 0 for Sunday, 1 for Monday, 2 for Tuesday, 3 for Wednesday, 4 for Thursday, 5 for Friday, and 6 for Saturday. So the meaning of "0 1 * * 0,1,2,6" is that you are selecting 0,1,2,6 which means Sunday, Monday, Tuesday, and Saturday. That way, you will be able to see and save the desired days in the ExpectedTime window. With the below values you will be able to select all the days in a week:

<value>"0 1 * * 0,1,2,3,4,5,6 ","0/00/0 01:00:00"</value>

Screenshots below: