CONTAP-733137: ARP/AI creates periodic snapshots every 8 hours instead of every 4 hours(default).

Starting with ONTAP 9.17.1, when ARP is enabled on a volume, ARP/AI creates a snapshot every 4 hours. It also creates additional snapshots when ransomware activity is detected. These snapshots allow customers to roll back to a clean, pre-infection state after an attack. ARP/AI automatically deletes these snapshots after a retention period that customers can configure.
 
Due to a regression, ARP periodic snapshots are being created every 8 hours instead of every 4 hours. This issue affects FlexVol volumes only; FlexGroup volumes are not impacted.
Impact:

• Larger data-loss window during recovery: If a customer rolls back using an ARP periodic snapshot, the most recent clean snapshot may be up to 8 hours old instead of 4 hours old. As a result, more data could be lost.

• Custom snapshot settings may not work as expected: If a customer has modified the ARP snapshot options described in Modify ARP/AI snapshot options (<[https://docs.netapp.com/us-en/ontap/...ns-arpai.html]>), those settings may not take effect as expected.

Customers can verify the current option value using the following command. The default value for this option is 4 hours.
::> options arw.snap.create.interval.hours
 
vserver    option-name                    option-value option-constraint-string
---------- ------------------------------ ------------ -----------------------------------------
svm            arw.snap.create.interval.hours 4            (same value in local+partner recommended)
 
{}1 entries were displayed.{}{}::> snapshot show -snapshot Anti* -fields create-time -volume <vol>{}
 
vserver volume snapshot                                        create-time
------- ------ ----------------------------------------------- ------------------------
svm     vol    Anti_ransomware_periodic_backup.2026-10-22_0031 Thu Oct 22 00:31:58 2026
svm     vol    Anti_ransomware_periodic_backup.2026-10-22_0832 Thu Oct 22 08:32:49 2026
 
2 entries were displayed.
In the example above, the ARP periodic snapshots were created approximately 8 hours apart despite the snapshot creation interval being configured for 4 hours, which demonstrates the issue.