Adding a log source to a WinCollect agent
When you add a new log source to a WinCollect agent or edit the parameters of a log source, the WinCollect service is restarted. The events are cached while the WinCollect service restarts on the agent.
Before you begin
If you configure a log source that uses a WinCollect plug-in, you must read the requirements and prepare the third-party device. For more information, see WinCollect plug-in requirements.
- Click the Admin tab.
- On the navigation menu, click Data Sources.
- Click the WinCollect icon.
- Click Agents.
- Select the WinCollect agent, and click Log Sources and then click Add.
- Choose one of the following options:
- For a WinCollect log source, select Microsoft Windows Security Event Log from the Log Source Type list and then select WinCollect from the Protocol Configuration list.
- For a WinCollect plug-in select the WinCollect plug-in option from the Log Source Type list, and then configure the specific parameters. For information about these parameters, see the configuration options for log sources that use WinCollect plug-ins.
- Configure the generic log source parameters.
- Click Save.
- On the Admin tab, click Deploy Changes.