To collect events from a different device that doesn't have the WinCollect 10 agent installed, create a
Remote source.
About this task
When you set up a
Remote source, you have the option to add multiple
remote sources at the same time.
Note: The following steps outline the procedure to add multiple
sources (Bulk Add). Adding a single device is very similar.
Procedure
-
Click Create Source.
- Select the Remote Type:
Option |
Description |
Single |
Add one remote source. |
Bulk |
Add up to 500 remote sources. |
- Select or create a Source Group to keep your related sources
together.
You can edit sources in bulk that are in the same group.
- Select a Source Type.
The Source
Type defines the type of logs you want to collect. For example, if you want to collect
standard Windows events then select Microsoft
Windows Events.
- Configure the Source Parameters.
- Microsoft
Windows Events
- Monitor common event channels within the Windows event
logging system, including XML queries (XPath).
- Enable the channels that you want to collect from.
- Select Credentials.
A credential contains login
information that the WinCollect agent
uses to connect to remote devices.
- Select Bulk Add Devices.
You can either upload a text
file with a list of devices to add one per line, or manually enter them one at a time and click
Add. Bulk Template file example
(
WinCollectBulkAddSample.txt)
172.18.100.200
172.18.100.201
test.example.net.workstation1
172.18.100.202
172.16.200.100
172.16.200.101
test.example.net.workstation2
172.18.200.102
- To perform a connection test, select the devices that you want to test.
The
test is performed when you proceed to the next step.
Note: A failed connection can take up to 20
seconds to time out.
- Select a Destination.
WinCollect destinations define the parameters
for how the
WinCollect agent forwards
events and logs to an
IBM®
QRadar®
appliance.
Tip: If you select an existing destination that is disabled, the wizard
enables it while configuring the source.
- Click Summary to view a list of the changes you made.
- Click Apply.