IBM Support

QRadar: Modify Event or Flow Collector Connection



Your deployment may require that the Collector connection point to a processor different from the default. In other instances, when re-adding an Event or Flow Collector back into a deployment, it might need to be modified so that the collector points to the correct Processor.

Resolving The Problem

To resolve this issue.
  1. Log in to the QRadar UI.
  2. Open the Admin settings:
    1. In IBM Security QRadar V7.3.1, click the navigation menu , and then click Admin to open the Admin tab.
    2. In IBM Security QRadar V 7.3.2, 7.3.0 or earlier, click the Admin tab.
  3. Click System and License Management.
  4. Click an Event Collector or QFlow to highlight the Appliance.
  5. Click Deployment Actions > Edit Host Connection.

  6. If the Appliance is a QFlow:

    From Modify Flow Collector Connection drop-down menu, choose the Appliance that you want to connect to.

  7. If the Appliance is an Event Collector:

    From the Modify Event Collector Appliance Connection drop-down menu, choose the Appliance that you want to connect to.

    Note: The Appliance with the Asterisk * is the Processor with the current Destination Connection.
  8. Click Save.
  9. From the Admin tab, click Deploy Changes.
Results: The Connection has been Changed.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.x;7.2.8","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
21 January 2021