The Primary and Secondary Managers exchange a "heartbeat" communication once each minute, . This communication includes a byte of data specific to the health of the Manager in question. Manager receiving the heartbeat concludes that its peer has failed under two scenarios:
One of the Trellix IPS subsystems reports a failure.
A heartbeat has not been received within the Downtime Before Switchover interval (configured using the Pair Creation action). For example, if the default interval is 5 minutes and the heartbeat is sent once a minute, the Secondary Manager takes control after five minutes of missed heartbeats.
If the Secondary Manager becomes unavailable, the Primary remains active and logs the failure. If the Primary Manager becomes unavailable, the Secondary logs the event and becomes active.
If both Managers are online but are unable to communicate with each other, the Secondary Manager queries each Sensor and becomes active only if more than half the Sensors cannot communicate with the Primary Manager.
Data synchronization between the Primary and Secondary Manager occurs every 15 minutes.