Restarting the event collection service

There might be situations when you want to restart only the event collection service across all managed hosts in your IBM QRadar environment. For example, when a new version of the ecs-ec-ingress service is available for upgrade, or when you deferred restarting the service during an earlier deployment.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. On the Advanced menu, click Restart Event Collection Services. Event collection is briefly interrupted while the service restarts.
    Note: You can also restart the event collection service at the command line by typing the following command: 
    systemctl restart ecs-ec-ingress