When you add a new log source to a WinCollect agent or edit the parameters of a log
source, the WinCollect service is restarted. The
events are cached while the WinCollect service
restarts on the agent.
Before you begin
If you configure a log source that uses a WinCollect plug-in, you must read the requirements
and prepare the third-party device. For more information, see WinCollect plug-in requirements.
Procedure
- Click the Admin tab.
- On the navigation menu, click Data Sources.
- Click the WinCollect icon.
- Click Agents.
-
Select the WinCollect agent, and click
Log Sources and then click Add.
- Choose one of the following options:
- For a WinCollect log source, select
Microsoft Windows Security Event Log from the Log Source
Type list and then select WinCollect
from the Protocol Configuration list.
- For a WinCollect plug-in select the WinCollect plug-in option from the Log
Source Type list, and then configure the specific parameters. For information about
these parameters, see the configuration options for log sources that use WinCollect plug-ins.
- Configure the generic log source parameters.
- Click Save.
- On the Admin tab, click Deploy
Changes.