Adding custom entries to WinCollect status messages
You can add custom information to the WinCollect Agent status messages.
Procedure
-
In the wincollect/config directory of the Windows host that you want to identify in LEEF logs, create a file that is called
heartbeat_custom.props.
Important: You can create, update, or delete this file while your WinCollect deployment is running. Updates to the file are available in logs on the next heartbeat.
-
Enter the custom information in the heartbeat_custom.props file in the
following format, with one entry on each line:
keyword=value
Example:department=Accounting
group=AC105
The log output with the example keywords and values looks like the following example:
<13>Jul 22 15:02:48 DESKTOP-0F0QKN3 LEEF:1.0|IBM| WinCollect|<version_number>.9999|2|src=DESKTOP-0F0QKN3 os=Windows 10(Build 10240 64-bit)dst= sev=3 log=Code.SSLConfigServerConnection department=Accounting group=AC105 msg=ApplicationHeartbeat
Important:- The heartbeat_custom.props must not exceed 10 KB.
- Custom keyword entries must be alpha-numeric and contain no spaces.
- Custom entries can't contain reserved keywords, such as src, os, dst, sev, log, msg.
- Custom values can't contain special characters, such as = | [ ] { } < > / \ ' " .
- Multiple white spaces in custom values are reduced to a single space.