Configure failover

1. To configure failover, create two or more instances of the interface.

   Each instance must have a unique failover ID (/failoverID=<identifier>).

   For example, for the primary instance of the interface /failoverID== Intf1, and for the secondary instance of the interface /failoverID== Intf2.

2. Configure the amount of time that the current primary interface must be unavailable before failover occurs (/swaptime=<time in seconds>).

Failover point format

When the interfaces are configured for failover, the current primary interface writes events to the failover point using the following format:

FailoverID | Last-processed timestamp in UTC

For example:

interface1 | 1325376000

Backup instances read the failover point. If the swap time is exceeded, indicating that the primary interface has become unavailable, the backup instance verifies the data and events in the cache time prior to the latest processed time stamp, then takes over data collection.