Restarting the event collection service

There might be situations when you want to restart only the event collection service across all managed hosts in your IBM® QRadar® environment. For example, when a new version of the ecs-ec-ingress service is available for upgrade, or when you deferred restarting the service during an earlier deployment.


  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. On the Advanced menu, click Restart Event Collection Services. Event collection is briefly interrupted while the service restarts.
    Note: You can also restart the event collection service at the command line by typing the following command:
    systemctl restart ecs-ec-ingress