In addition to the current ElementState defined values:
- Active = 1
- Deleted = 6
- Error = 10
- Hidden = 2
- Masked = 12
- Paused = 3
- Restart = 11
- Stopped = 4
- Undefined = 0
is there a new value describing the element state "swarmed".
The purpose is to detect(Correlation rule) when a specific element is swarmed and run some automation.
Hi Souhail,
Maybe you can trigger on the information event that is generated during a swarm action?
Your correlation rule should then be configured to accept information events and filter on the swarming parameter like this:
I also let it trigger on single events. Hope this helps?
When an element swarms there is no new state describing Swarming.
As the element is restarting on another agent the state changes as follows:
Active -> Stopped -> Active (starting) -> Active (started)
However you can catch the swarm on the Stopped event (ElementStateEventMessage) as it will specify the reason with a TimeoutSubState of IsSwarming.
I'm also curious to know what automation you will want to run on this?
Thanks Robbie for your update.
Mainly, the automation will update the trap ip address in some device to force it sending notification to the new host agent