What do the AI Learning evaluation periods (30 min / 1 day … 1 day / 3 months) mean?

Short answer

Each option in AI Learning Frequency carries two durations: how often the run is made and how much Event Logs record is read backward in every run (the window in parentheses). "30 minutes (1 days)" reads the last 1 day every half hour, "1 hours (2 days)" the last 2 days every hour, "2 hours (4 days)" the last 4 days every two hours, "6 hours (1 weeks)" the last 1 week every six hours, "12 hours (2 weeks)" the last 2 weeks every twelve hours, and "1 days (1 months)" and "1 days (3 months)" the last 1 month or 3 months once a day. The run is triggered at exact multiples of the period starting from midnight according to the device's clock: 1 hours runs at the top of every hour, 12 hours at 00:00 and 12:00, and 1 days at 00:00. Every run operates with two limits proportional to the period: at most the period's seconds × 25 rows are read, and of these, at most the period's seconds × 5 records that pass the filters are evaluated (90,000 and 18,000 for 1 hours); since the records are read from the newest to the oldest, on very busy sites the old part of a long window may not be reached. If no option is selected (None), the run is not made and the Learning Methods card shows the "AI learning is on but no period is selected" warning.

Options

Option	Run	Window read	Maximum rows read	Maximum records evaluated
30 minutes (1 days)	Every 30 minutes	Last 1 day	45,000	9,000
1 hours (2 days)	At the top of every hour	Last 2 days	90,000	18,000
2 hours (4 days)	Every 2 hours	Last 4 days	180,000	36,000
6 hours (1 weeks)	00:00, 06:00, 12:00, 18:00	Last 1 week	540,000	108,000
12 hours (2 weeks)	00:00, 12:00	Last 2 weeks	1,080,000	216,000
1 days (1 months)	00:00	Last 1 month	2,160,000	432,000
1 days (3 months)	00:00	Last 3 months	2,160,000	432,000
None	Not made	-	-	-

• As the window gets longer, infrequent but legitimate flows can collect evidence; the row and record limits, however, depend on the period, so the "1 days (3 months)" option operates with the same limits as "1 days (1 months)".
• The run is made only while the AI Learning switch is on; while the switch is off, the selected period is preserved but not used. In a cluster, the run is made on the first device; the records of the peer device are also read with the same limits; the evidence is counted separately per device, and the suggestions are merged into a single list, but the evidence is not added up.
• The AI Learning Tracking view also reads the window of the selected period; the number of rows it will read, however, is determined by the user's Line Limit value (What are the Min Progress (%), Max Suggestions and Line Limit advanced settings for?).
• In WEB-CLI, the options are written to the --collectiveLearningFrequency field as 30dk_1g, 1sa_2g, 2sa_4g, 6sa_1ha, 12sa_2ha, 1g_1ay or 1g_3ay; with any other value, the run is not made.
• Teacher period: How long until Teacher traffic becomes a rule; is a single request enough?

Common Misconceptions

• "The period is only the run frequency." Each option also determines the window of records to be read.
• "A long window always means more evidence." The number of rows read and records evaluated is limited by the period; on busy sites, the old part of the window may not be reached.
• "The run is counted from the moment the setting is saved." The runs start at multiples of the period from midnight according to the device clock.

How it is done in the documentation

• Learning Methods · AI Learning Frequency
• AI Learning & Teacher Tracking · Views
• WEB-CLI waf options · The AI Learning

Related questions

• What is AI Learning and how does it work?
• How long until Teacher traffic becomes a rule; is a single request enough?
• How is Learning Progress read (Request, Client, Country, ASN network axes); why is the lowest axis decisive?