IBM Support

QRadar: WinCollect File Forwarder Displays an Error and Not Receiving Events

Troubleshooting


Problem

The following technical note outlines some basic troubleshooting steps for WinCollect log sources that use WinCollect File Forwarder protocol.

Symptom

The Log source is in error with the message: ERROR - Events have not been received from this Log Source in over 720 minutes.

Resolving The Problem

Administrators must review the Universal DSM log source to determine that it is correctly configured. The most common causes of event collection errors are as follows:

  • Verify that the files are not binary. Files such as EVT or EVTX files are binary and cannot be read by WinCollect. The WinCollect File Forwarder protocol supports ASCII or plain-text files.
  • Ensure that new events are written to the file configured in the log source. If no new events are periodically written to files, WinCollect has no data to forward.
  • Verify that the process that creates the logs or appends data to the monitored files is working as intended.
  • Validate that log file rollover or the method of writing to the file has not changed for the event source.
  • Ensure that the files are in the proper directory as specified in the log source and that the user who is specified in the log source has access to the directory.
  • Verify the regular expression in the File Pattern field of the log source matches the file name.


Where do you find more information?




[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.1;7.3;7.2.8;7.2","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
10 May 2019

UID

swg21679876