Switch the roles of the primary and secondary Trellix Enterprise Security Manager - Event Receiver when upgrading a receiver, preparing to return a receiver to the manufacturer, or moving cables on a receiver. Switching roles minimizes potential data lost.
Note
If a collector (including the ePO - On-prem device) is associated with a Receiver-HA and the Receiver-HA fails over, the collector can't communicate with the Receiver-HA until the switches between the two associates the new MAC address of the failed-over Receiver to the shared IP address. This can take a few minutes or a few days, depending on the current network configuration.
On the system navigation tree, select the Receiver-HA device, then click the Properties icon
.png "GUID-F191D568-8B93-4D2C-9BFC-F1342FC407BD-low.png")
.Select → .
Trellix ESM instructs the secondary Receiver to start using the shared data source IP address and collecting data.
The secondary Receiver issues a Cluster Resource Manager (CRM) command to switch the shared IP address and MAC, and starts the collectors.
Trellix ESM pulls all alert and flow data from the primary Receiver.
Trellix ESM selects the secondary Receiver as the primary and selects the primary Receiver as the secondary.