Configuring a local source

If you didn't use the Quick Installation option to install your agent, you can still configure the agent to collect System, Application, and Security events on the local asset. You can use the Configuration Console or run an update script to configure the agent.

1. On the WinCollect 10 Console, click the menu icon and select Local Sources.
2. In the Local Sources window, select Local source, which was created by default during the WinCollect installation.
3. In the Edit view, click Add to configure the event channels that you want to collect.
   1. In the Source Collection window, select Channel > Application, and click Save.
      Tip: You do not need to enter a Name or Identifier.
   2. Select Channel > Security, and click Save.
   3. Select Channel > System, and click Save.
   Tip: In WinCollect 10, you can configure each channel (source) differently. In previous WinCollect versions, all channels used the same configuration set.
   The three channels are now listed in the Source section.
4. You must configure the Destination, using information from your IBM® QRadar® deployment:
   You can specify any application in your deployment where you like to send the event to.
   1. Click the menu icon, and select Destinations.
   2. Select the default QRadar destination.
   3. On the Edit window, select Enabled.
   4. Type the Hostname or IP address of the QRadar appliance that you want to send the events to.
      Tip: Leave all other options on their default values.
   5. Click Save.
   6. On the Destinations window, click Save.
5. To deploy your changes, click the notifications icon, then click Apply Changes.