We lost a switch that was part of a stack and are getting DFM traps and Cisco syslog messages into our CIC netcool console. When we lost the switch we received both a DFM cswStackmemberRemoved event and also a Cisco STACKMGR SWITCH-REMOVED syslog msg.
Our question is which event is better to use in this case to generate a Critical Alert in CIC. The syslog message gives the switch number but would require rule work to match the switch added msg to the switch removed message. the DFM event we assumed is a polled event that will automatically generate a clear to CIC when the switch is again added.
Which event would be best to use in CIC ?