Manually adding a WinCollect agent

If you delete your WinCollect agent, you can manually add it back. To reconnect to an existing WinCollect agent, the host name must exactly match the host name that you used before you deleted the agent.

When you delete a WinCollect agent, the IBM® Security QRadar® Console removes the agent from the agent list and disables all of the log sources that are managed by the deleted WinCollect agent.

WinCollect agents that were previously automatically discovered are not rediscovered in WinCollect. To add a deleted WinCollect agent back to the agent list in the QRadar, you must manually add the deleted agent.

For example, you delete a WinCollect agent that has a host identifier name VMRack1. You reinstall the agent and use the same host identifier name, VMRack1. The WinCollect agent does not automatically discover the WinCollect agent.

Procedure

  1. Click the Admin tab.
  2. On the navigation menu, click Data Sources.
  3. Click Agents.
  4. Click Add.
  5. Configure the parameters.

    The following table describes some of the parameters:

    Table 1. WinCollect agent parameters
    Parameter Description
    Host Name
    Depending on the method that you used to install the WinCollect agent on the remote host, the value in the Host Name field must match one of the following values:
    • HOSTNAME field in the WinCollect agent command-line configuration
    • Host Identifier field in the WinCollect agent installer.
    Description

    Optional.

    If you specified an IP address as the name of the WinCollect agent, add descriptive text to identify the WinCollect agent or the log sources the WinCollect agent is managing.
    Automatic Updates Enabled Controls whether configuration updates are sent to the WinCollect agent.
    Heart Beat Interval

    This option defines how often the WinCollect agent communicates its status to the Status Server. The interval ranges from 1 - 20 minutes.
    Configuration Poll Interval Defines how often the WinCollect agent polls the QRadar Configuration server for updated log source configuration information or agent software updates. The interval ranges from 1 minute to 20 minutes.
    Maximum TCP/UDP Payload The WinCollect agent uses whatever setting is selected in QRadar for the maximum TCP/UDP payload size.
  6. Click Save.
  7. On the Admin tab, click Deploy Changes.

    The WinCollect agent is added to the agent list.