Creating a remote source
To collect events from a different device that doesn't have the WinCollect 10 agent installed, create a Remote source.
About this task
When you set up a Remote source, you have the option to add multiple remote sources at the same time.
Note: The following steps outline the procedure to add multiple sources (Bulk Add). Adding a single device is very similar.
- Click Create Source.
- Select the Remote Type:
Option Description Single Add one remote source. Bulk Add up to 500 remote sources.
- Select or create a Source Group to keep your related sources
together. You can edit sources in bulk that are in the same group.
- Select a Source Type. The Source Type defines the type of logs you want to collect. For example, if you want to collect standard Windows events then select Microsoft Windows Events.
- Configure the Source Parameters.
- Microsoft Windows Events
- Monitor common event channels within the Windows event logging system, including XML queries (XPath).
- Enable the channels that you want to collect from.
- Select Credentials. A credential contains login information that the WinCollect agent uses to connect to remote devices.
- Select Bulk Add Devices. You can either upload a text file with a list of devices to add one per line, or manually enter them one at a time and click Add. Bulk Template file example (WinCollectBulkAddSample.txt)
172.18.100.200 172.18.100.201 test.example.net.workstation1 172.18.100.202 172.16.200.100 172.16.200.101 test.example.net.workstation2 172.18.200.102
- To perform a connection test, select the devices that you want to test. The test is performed when you proceed to the next step.Note: A failed connection can take up to 20 seconds to time out.
- Select a Destination. WinCollect destinations define the parameters for how the WinCollect agent forwards events and logs to an IBM® QRadar® appliance.Tip: If you select an existing destination that is disabled, the wizard enables it while configuring the source.
- Click Summary to view a list of the changes you made.
- Click Apply.