Migrating WinCollect agents after a QRadar hardware upgrade

After a QRadar® hardware upgrade, you need to generate a new authorization token for your WinCollect agents and update their install_config files.

About this task

Procedure

  1. Generate an authentication token. For more information, see Creating an authentication token for WinCollect agents.
    Note: This capability is not available in IBM QRadar on Cloud.
  2. Stop the WinCollect agent service.
  3. Delete the certificate file C:\Program Files\IBM\WinCollect\config\ConfigurationServer.PEM
  4. Update the \WinCollect\config\install_config.txt file with the IP address of your new Console.
  5. Run the following command, where <auth_token> is the authentication token that you generated in step 1:
    C:\Program Files\IBM\WinCollect\bin\InstallHelper.exe -T <auth_token> -a "C:\Program Files\IBM\WinCollect\config\install_config_autocreate.txt"
    C:\Program Files\IBM\WinCollect\bin\InstallHelper.exe -T xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -a "C:\Program Files\IBM\WinCollect\config\install_config_autocreate.txt"
  6. Restart the WinCollect agent.