Question & Answer
Question
In the WinCollect logs, the error message:" System.WinCollectSvc.Service : Could not restart agent process after unexpected exit." What does this mean?
Answer
When this issue occurs, administrators should view the Task Manager to ensure that there are no duplicate WinCollect.exe processes running on the Windows host. If there multiple WinCollect.exe processes running, right-click on the WinCollect.exe and select End Process and repeat this for each WinCollect.exe that is running.
The administrator can also review for duplicate WinCollectsvc.exe processes and end duplicates of the WinCollect service.
After you have removed duplicate exe files running from the Task Manager, the administrator should restart the WinCollect service, which will start a new instance of WinCollect.exe.
The purpose of WinCollectsvc.exe is to send status messages about the Wincollect agent (WinCollect.exe) and ensure that the agent stays running.
For additional questions about WinCollect, administrators should review the Windows Event Collection (WinCollect / MSRPC / WMI) Forum.
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.1;7.2","Edition":"Advanced","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
03 December 2020
UID
swg21681152