How Do I Switch a System That’s Running RITA Every 2 Hours to Running It Every Hour?

The earliest releases of AC-Hunter ran RITA every 2 hours. If you’ve had AC-Hunter for a long time and have upgraded it in place, that setting may still be there.

Current releases of AC-Hunter run RITA every hour so you can see your data with less delay. To make this change:

• Log in to the AC-Hunter host.
• Edit /etc/AC-Hunter/config.yaml with your preferred editor:

sudo vim /etc/AC-Hunter/config.yaml

• Locate the Schedule line under the RITA: section (note; there are multiple “Schedule:” lines in this file). If it’s currently set to run every two hours, it will look like:

Schedule: "0 20 0-23/2 * * *"

(If it doesn’t have the “/2” following 0-23, RITA is already run every hour and you can stop here.)

• Remove the “/2” from that line so it now looks like:

Schedule: "0 20 0-23 * * *"

Be careful not to change the number of spaces at the beginning of that line. Save your changes and exit.

• Now load these changes into AC-Hunter with the following commands.

sudo ./hunt down
sudo ./hunt up -d --force-recreate

• As a side note, when AC-Hunter is restarted, RITA is automatically run.

Direct Link to this FAQ Item: https://portal.activecountermeasures.com/support/faq/?Display_FAQ=2769