System advanced settings
You can use the following advanced settings to more accurately tune the system that contains the WinCollect 10 agent.
| Parameter | Default value | Description |
|---|---|---|
| Max Archived Patch Folders | 20 | The maximum number of patch archive folders (patch_yyyymmdd_hhmmss) to keep. |
| Configuration Console's Port | 3000 | The port that the agent's webserver hosts the configuration console on. |
| Maximum Entity Read Buffer | 16384 | The size of the buffer to read large entities from the console UI. |
| Check patch folder every (seconds) | 10 | How often to check whether files are in the patch folder. Select 0 to disable. |
| Check for expired cached IP every (seconds) | 60 | How often to check whether cached IPs are expired. Select 0 to disable. |
| Check the health of the system every (seconds) | 30 | How often to check sources, targets, threads, and resources. |
| Source device retry wait time | 60000 | The initial wait time (ms) to try to reconnect to a source device. The default value is 1 minute. |
| Source device maximum retry amount | 0 | The number of times to try to reconnect to a source device before it gives up. Select 0 to keep trying indefinitely. |
| Source device exponential wait factor | 5 | The exponential factor to increase wait time after each try. The default setting of 5 tries at 5 minutes, 25 minutes, 125 minutes... Select 1 to use linear wait factor. |
| Source device linear wait factor | 0 | The linear factor to increase wait time after each try. Example: If the retry wait time is 300000 (5 minutes), and the wait factor is 1, the source tries at 5 minutes, 10 minutes, 15 minutes... |
| Source device maximum retry wait time | 360000 | The max wait time to try to reconnect to a source device. The default value is 1 hour. |
| Bad SID Translation text | N/A | The text to use when a SID cannot be translated, use IGNORE to leave the SID as is. |
| Source start query delay time | 1000 | Delay in milliseconds to start querying the sources. |
| Source start duration | Auto | How long to take to start querying all the sources, AUTO queries up to 25 per second and evenly spread the load over 5 seconds. |
| Source minimum thread count | 0 | 0 means auto calc (DvcCnt/100) |
| Source maximum thread count | 0 | 0 means auto calc (DvcCnt/20) |
| Source batch size | 100 | |
| Source cached IP expiration time (seconds) | 900 | Seconds to keep the computed IP cached for each remote device. The default value is 15 minutes. Select 0 to disable refresh. |
| Destination maximum number of events in memory | 10000 | The maximum number of events in memory that are waiting to be sent before the agent starts
dumping to disk. Note: This setting is per destination.
|
| Destination device retry wait time | 10000 | The initial wait time (ms) to try to reconnect to a destination. The default value is 10 seconds. |
| Destination device maximum retry amount | 0 | The number of times to try to reconnect to a destination before it gives up. Select 0 to keep trying indefinitely. |
| Destination device exponential wait factor | 1 | The exponential factor to increase wait time after each try. Select 1 to use linear wait factor. |
| Destination device linear wait factor | 10000 | The linear factor (ms) to increase wait time after each try. Example: If the retry wait time is 10000 (10 seconds), and the wait factor is 1, the source tries at 10 seconds, 20 seconds, 30 seconds... |
| Destination device maximum retry wait time | 300000 | The maximum wait time (ms) to try to reconnect to a destination. The default value is 5 minutes. |
| Destination.MaxPayload.HTTP | (optional) | The max payload size for HTTP/HTTPS. This is the max payload of each event in the POST body. Use Destination.MaxRequestLength.HTTP to limit the full size of the request. |
| Destination.MaxPostRequest.HTTP | (optional) | The max size of a single POST request for HTTP/HTTPS in MB. Set to 0 for no maximum size. |
| Destination maximum payload size for UDP | 1020 | The maximum payload size for UDP. |
| Destination maximum payload size for TCP | 32000 | The maximum payload size for TCP/TLS. |
| Check Primary every (seconds) | 60 | How often to check whether the primary destination is back online when the agent is using the secondary destination. |
| Use non blocking socket connection | Enabled | Use non blocking socket connection works in combination with Socket connection timeout setting. |
| Socket connection timeout | 10000 | Milliseconds allowed to connect. |
| Socket connection established wait time | 50 | Milliseconds to wait for a connection to be established between checks. |
| Allow live statistics collection | Enabled | While the console is running, the agent collects live stats for the Dashboard once per second. |
| Statistics heartbeat timeout | 120 | If the agent doesn't receive a request from the console after 120 seconds, it stops collecting live stats. |
| Minimum task count in queue for using index | 24 | The minimum number of tasks in the queue before the agent starts using an index. |
| Number of tasks per node in index | 8 | The number of tasks per node in the index. |
| Number of task requeue in index | 20 | The number of times a task is put back in the queue before the agent checks the average sequential search. |
| Maximum average number of sequential tasks | 16 | The maximum average number of sequential tasks to search per node before reindexing. |
| User data directory | %ALLUSERSPROFILE%/WinCollect/Data/ | The directory where WinCollect stores events, raw messages, and bookmarks. |
| Events on disk max disk space | 6144 | The maximum disk space to use (MB), when pushing events on disk when unable to send. |
| Max worker pool kill timeout | 10000 | The total time allocated to peaceful termination of the whole worker pool split equally between the number of workers in the pool. |
| Max worker kill timeout | 2000 | The maximum timeout allowed per worker regardless of the pool maximum. |
| Socket.Connect.IPv4Enabled | true | Enable agent communication to work over Internet Protocol Version 4. This setting can be enabled at the same time as IPv6. |
| Socket.Connect.IPv6Enabled | true | Enable agent communication to work over Internet Protocol Version 6. This setting can be enabled at the same time as IPv4. |
IPv6 support
The IPv6 protocol must be enabled on your Windows agent, and any Windows hosts that you poll that use IPv6.
To enable IPv6 support, open the console, enable the Advanced UI, and navigate to the Advanced
Settings. Enable or disable the options Socket.Connect.IPv4Enabled and
Socket.Connect.IPv6Enabled. The following caveats apply.
- If
Socket.Connect.IPv4Enabledis enabled, IPv4 addresses can be used and WinCollect will attempt to resolve hostnames to an IPv4 address. - If
Socket.Connect.IPv6Enabledis enabled, IPv6 addresses can be used and WinCollect will attempt to resolve hostnames to an IPv6 address. - If both options are enabled, IPv4 and IPv6 addresses can be used and WinCollect will attempt to resolve hostnames to either IPv4 or IPv6. The priority is determined by your operating system settings.
- If neither options are enabled, the default option (IPv4 Enabled) will be used.
Communication with other Windows devices, such as remote polling and Active Directory lookups, support both IPv4 and IPv6 regardless of which options are selected. The availability and priority of IPv6 and IPv4 communication when you use these features depend on your operating system's settings.