Adding a destination to the WinCollect Configuration Console

Add an IBM® QRadar® instance as a destination for WinCollect data.

Procedure

  1. In the WinCollect Configuration Console, expand the Destinations parameter.
  2. Right-click the Syslog TCP or Syslog UDP parameter, depending upon which destination type you want to add, and click Add New Destination.
    Note: If you want to specify a secondary destination, you must select the TCP Protocol.
  3. In the New Destination Name box, add a name for the destination. Click OK.
    Important: It is helpful to provide a destination name that includes the IP address, such as QRadarEP1_198.x.x.x. If you have to edit the log source and change a destination in the future, you can determine the IP address for the destination.
  4. Expand Syslog TCP or Syslog UDP, and select the destination that you added to view the Properties window.
  5. Define the Name, Hostname, Port, and Throttle for the new destination.
  6. If you have Data Sync and want to add a Secondary Destination to receive events if the primary destination fails, add the IP address or hostname.
  7. If you added a Secondary Destination, enter the number of seconds that the primary destination must be unreachable before the agent begins sending events to the secondary destination in the Secondary Failover (seconds) field.
  8. Click Deploy Changes under Actions.
    Note: Stand-alone deployments of WinCollect 7.3.0 and later support adding a secondary destination.