}

			certificate, err := certs.NewCertificate(env.Get(EnvKESClientCert, ""), env.Get(EnvKESClientKey, ""), loadX509KeyPair)
			if err != nil {
				return nil, err
			}
			certificate.Watch(ctx, 15*time.Minute, syscall.SIGHUP)

			conf.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
				cert := certificate.Get()
				return &cert, nil
			}
		}

		var caDir string

	keepAliveTicker := time.NewTicker(1 * time.Second)
	var progressTicker *time.Ticker
	var progressTickerC <-chan time.Time
	if writer.getProgressFunc != nil {
		progressTicker = time.NewTicker(1 * time.Minute)
		progressTickerC = progressTicker.C
	}
	recordStagingTicker := time.NewTicker(500 * time.Millisecond)

	// Exit conditions:
	//
	// 1. If a writer.write() returns false, select loop below exits and

All replication failures are picked up by the scanner which runs at a one minute frequency, each time scanning up to a sixteenth of the namespace. Object versions marked `PENDING` or `FAILED` are re-queued for replication.

	}

	if len(poolIndices) > 0 && globalEndpoints[poolIndices[0]].Endpoints[0].IsLocal {
		go func() {
			// Resume decommissioning of pools, but wait 3 minutes for cluster to stabilize.
			if err := sleepContext(ctx, 3*time.Minute); err != nil {
				return
			}
			r := rand.New(rand.NewSource(time.Now().UnixNano()))
			for {
				if err := z.Decommission(ctx, poolIndices...); err != nil {

	c.Assert(err, nil)

	// Check if bucket modtime is consistent (not less than current time and not late more than 5 minutes)
	timeNow := time.Now().UTC()
	c.Assert(creationTime.Before(timeNow), true)
	c.Assert(timeNow.Sub(creationTime) < time.Minute*5, true)
}

// This tests validate if PUT handler can successfully detect signature mismatch.

		globalBucketTargetSys.set(buckets[i], meta) // set remote replication targets
	}
}

func (sys *BucketMetadataSys) refreshBucketsMetadataLoop(ctx context.Context) {
	const bucketMetadataRefresh = 15 * time.Minute

	sleeper := newDynamicSleeper(2, 150*time.Millisecond, false)

	t := time.NewTimer(bucketMetadataRefresh)
	defer t.Stop()
	for {
		select {
		case <-ctx.Done():
			return
		case <-t.C:

	rx.sma.addSample(rx.Curr)
	rx.Avg = rx.sma.simpleMovingAvg()
	if rx.Curr > rx.Peak {
		rx.Peak = rx.Curr
	}
	rx.N++
}

// ReplicationMRFStats holds stats of MRF backlog saved to disk in the last 5 minutes
// and number of entries that failed replication after 3 retries
type ReplicationMRFStats struct {
	LastFailedCount uint64 `json:"failedCount_last5min"`

    /**
     * Default constructor for SearchLogHelper.
     */
    public SearchLogHelper() {
        // Default constructor
    }

    /** Interval for checking user information in milliseconds (default: 10 minutes). */
    protected long userCheckInterval = 10 * 60 * 1000L; // 10 min

    /** Maximum size of the user information cache. */
    protected int userInfoCacheSize = 10000;

    /** Queue for storing search logs. */

    private volatile boolean skipMaskingForDebugLevel = false;

    // Rate limiting
    private final Map<String, AtomicLong> rateLimitCounters = new ConcurrentHashMap<>();
    private volatile long rateLimitWindow = 60000; // 1 minute
    private volatile int maxEventsPerWindow = 10000; // Increased for tests

    /**
     * Security event types
     */
    public enum EventType {

        }
    }

    private void performHealthCheck() {
        for (ChannelInfo channel : channels.values()) {
            if (channel.getIdleTime() > 60000) { // 1 minute idle
                // Send keep-alive
                try {
                    sendKeepAlive(channel);
                } catch (Exception e) {