IBM Support

Collecting logs for QRadar WinCollect agent issues

Question & Answer


Question

How do you collect needed information and logs for WinCollect agent issues?

Answer

Administrators who experience issues with WinCollect agents need to submit the following information with the support ticket.

Providing a problem description
  1. A description of the issue, Windows operating systems, and any hostnames or IP addresses that are affected.

    Example:
    • I added 250 log sources by using the log source bulk add feature with WinCollect, and they recently stopped sending events. The last event time is The WinCollect agent name is ____ and the log sources that I want investigated are hostA (1.1.1.1), hostB (1.1.1.2), hostC (1.1.1.3), and hostD (1.1.1.4). Here is a screen capture of the log source configuration.
    • I installed a new WinCollect agent on hostnameX by using the command-line installer, but it did not work. I tried several more times, but the WinCollect agent does not automatically create my log source. I attached a text file is with the installation command I used, see WC_install.txt.
  2. A compressed file that contains the /config and /logs directory for the WinCollect agent.

    Instructions for collecting the WinCollect /config and /logs directories:
    1. Log in to the Windows operating system that hosts the WinCollect agent.
    2. Click Start > All Programs > Administrative tools > Services.
    3. Select the WinCollect service.
    4. Click Stop.

    5. Click Start > All Programs > Accessories > Windows Explorer.
    6. Navigate to the WinCollect installation directory. The default path is, C:\Program Files\IBM\WinCollect.
    7. To select multiple folders, press Ctrl, and select the config and logs folders.
    8. Right-click on one of the selected folders and select Send to > Compressed (zipped) folder.

    9. Click Start > All Programs > Administrative tools > Services.
    10. Select the WinCollect service.
    11. Click Start.
    12. Log in to the support portal to make a service request, IBM Security QRadar SIEM.
    13. Click Open a new service request > sign in.
    14. Attach the log file with your description of the issue to the service request ticket.
 

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF033","label":"Windows"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
04 January 2023

UID

swg21990785

Page Feedback