This release note contains upgrade instructions and a list of fixed issues for IBM Security WinCollect Agent 7.2.6. Questions about this version / upgrade can be discussed in the WinCollect forums.
- Warning: Known issue identified in WinCollect 7.2.6
- Before you begin
- About WinCollect v7.2.6: Known & fixed issues list
- Prerequisites for the WinCollect upgrade
- How to upgrade to WinCollect v7.2.6
- WinCollect RPMs contained in the SFS installer
An issue has been identified in WinCollect 7.2.6 where remote event collection stops on monitored Microsoft Windows computers after the host is rebooted. Administrators who have installed WinCollect 7.2.6 should update their log source configurations to select the MSEVEN protocol to ensure event collection is uninterrupted. An APAR IV96608 has been opened for administrators to track this issue. A new version of WinCollect will be released to resolve this issue soon.
Before upgrading a QRadar Console 7.2.x, WinCollect must be at version 7.2.2-2 or higher. If the WinCollect version is below 7.2.2-2, install WinCollect 7.2.2-2 first. Make sure that all Windows host agents have updated to WinCollect 7.2.2-2 before proceeding to upgrade to WinCollect 7.2.6. Administrators can verify that the Windows host agents have updated to WinCollect 7.2.2-2 by looking at C:\Program Files\IBM\WinCollect\config\AgentCore.manifest. The Build Number for WinCollect 7.2.2-2 should be 1018564. For more information, review the section Prerequisites for the WinCollect Upgrade.
Due to QRadar 7.1.x being end of engineering, there is no WinCollect 7.1.x SFS file being released to upgrade to WinCollect 7.2.6. Administrators interested in installing WinCollect 7.2.6 must upgrade their QRadar deployment to the QRadar 7.2 software version. No QRadar 7.1.x upgrade files are being offered to upgrade to WinCollect 7.2.6.
Supported Windows operating systems
- Windows Server 2016
- Windows Server 2008 (most recent)
- Windows Server 2008 Core
- Windows Server 2012 (most recent)
- Windows Server 2012 Core
- Windows 7 (most recent)
- Windows 8 (most recent)
- Windows 10 (most recent)
- Windows Vista (most recent)
NOTE: WinCollect is not supported on versions of Windows that have been moved to End Of Life by Microsoft. After software is beyond the Extended Support End Date the product might still function as expected; however, IBM will not make code or vulnerability fixes to resolve WinCollect issues for older operating systems. For more information, see the WinCollect User Guide.
Administrators should be aware that supported software versions for IBM WinCollect is the Latest version (n) and latest minus one (n-1). This means that the two newest versions of WinCollect are the versions that QRadar Support will recommend with any support tickets (cases) that are opened. To prevent issues, it is important that administrators keep WinCollect deployments updated when new versions are posted to IBM Fix Central. For questions related to this statement, ask in the WinCollect forum: http://ibm.biz/wincollectforums.
A new SFS file has been posted to IBM Fix Central for WinCollect Agent version 7.2.6. This update resolves multiple issues reported in the previous WinCollect release. Questions about this version / upgrade can be discussed in our new WinCollect forums here: WinCollect / Windows Event Collection forum.
|IV96608||WARNING: AN ISSUE HAS BEEN IDENTIFIED IN WINCOLLECT 7.2.6 WHERE REMOTE EVENT COLLECTION STOPS ON MONITORED MICROSOFT WINDOWS COMPUTERS AFTER THE HOST IS REBOOTED.|
|NEW FEATURE||ADDED TLS PROTOCOL AND CERTIFICATE TO STAND_ALONE INSTALL.|
|NEW FEATURE||ADDED ALLOW DASH IN DOMAIN NAME.|
|NEW FEATURE||ADDED INCLUSION FILTER TO ALL LOG TYPES.|
|NEW FEATURE||ADDED NSA EVENT FILTER TO APPLICATION, SECURITY, SYSTEM AND DNS FILTER TYPES.|
|IV91737||KOREAN LANGUAGE CHARACTERS DO NOT DISPLAY CORRECTLY IN EVENTS THAT ARE GATHERED USING WINCOLLECT FILE FORWARDING|
|IV92211||EVENT PAYLOAD IS TRUNCATED AFTER 'MESSAGE=' FOR WINDOWS EVENT ID 4688 WHEN USING AN XPATH QUERY IN A WINCOLLECT LOG SOURCE|
|IV96284||UPGRADING THE WINCOLLECT .SFS CAN REQUIRE AN ADDITIONAL 'DEPLOY FULL CONFIGURATION' TO COMPLETE SOME AGENT INSTALLATIONS|
|IV96364||THE WINCOLLECT 7.2.6 .SFS FOR QRADAR 7.3 NEEDS TO BE APPLIED AFTER UPGRADING QRADAR FROM 7.2.8.X TO 7.3.0.X|
|QRadar Version||Minimum WinCollect Version||RPM Minimum Version|
|QRadar 7.3.x (any patch level)||WinCollect 7.2.5||AGENT-WINCOLLECT-7.3-20161123160813.noarch|
|QRadar 7.2.x (any patch level)||WinCollect 7.2.2-2||AGENT-WINCOLLECT-7.2-1018607.noarch|
- Log in to the QRadar Console.
- From the Navigation bar, click Help > About.
- Click Additional Information and verify you have the base software and RPM versions installed.
Before you begin
- To avoid access errors in your log file, close all open QRadar sessions.
- Verify that all changes are deployed on your appliances.
- Installing the SFS file forces a Tomcat restart on the Console, which will log out QRadar users and stop any reports running in the background. Administrators should be aware of this service restart to schedule maintenance time appropriately.
- It is possible for the administrator to prevent a software update to a critical business asset or server from the WinCollect agent list on the Admin tab. To prevent a host from being updated, the Enable Automatic Updates field must be set to false before you install the SFS file to the Console. For more information, see http://www.ibm.com/support/docview.wss?uid=swg21685330.
- The WinCollect Agent SFS file can only be installed on the QRadar Console appliance. Installing the WinCollect Agent update SFS on a managed hosts will display an error message to the administrator.
This section outlines how to install WinCollect 7.2.6 on the QRadar Console. The WinCollect update only needs to be installed on the QRadar Console. The Console appliance will replicate all required files to other QRadar appliances in the deployment.
To upgrade existing WinCollect agents, the administrator must to install the SFS file on the QRadar Console appliance. The SFS contains protocol updates and WinCollect Agent software to remotely update Windows hosts with WinCollect 7.2.6.
|Step 1||Step 2|
|Install the proper file on your QRadar Console. The procedure below outlines in installation steps for administrators.|
For QRadar 7.3.x Consoles: 730_QRadar_wincollectupdate-18.104.22.168.sfs
For QRadar 7.2.x Consoles: 720_QRadar_wincollectupdate-22.214.171.1244.sfs
NOTE: Due to QRadar 7.1.x being end of engineering, there is no WinCollect 7.1.x SFS file being released to upgrade to WinCollect 7.2.6. Administrators interested in installing WinCollect 7.2.6 must upgrade their QRadar deployment to the QRadar 7.2 software version. No QRadar 7.1.x upgrade files are being offered to upgrade to WinCollect 7.2.6.
|Wait for installs to complete and update the user interface to WinCollect 7.2.6.|
These instructions are intended for standard upgrades of WinCollect. If you are using 'Stand-alone' mode, you must download and install the WinCollect Standalone Patch Installer 7.2.6 for each Windows host to upgrade your agents. The instructions provided below are for managed WinCollect installations.
- Download a WinCollect Agent (v7.2.6) bundle (.SFS) from the IBM Fix Central website for your QRadar version for your major version number:
- For 7.3.x Version Consoles Download 730_QRadar_wincollectupdate-126.96.36.199.sfs
- For 7.2.x Version Consoles Download 720_QRadar_wincollectupdate-188.8.131.524.sfs
Note: The installation process will restart services on the Console, which will create a gap in event collection until services restart. Administrators should be aware of the service restart so they can schedule their upgrades during a maintenance window.
NOTE: To proceed with the WinCollect Agent update services need to be restarted on QRadar to apply protocol updates. This The following message is displayed:
WARNING: Services need to be shutdown in order to apply patches. This will cause an interruption to data collection and correlation.
Do you wish to continue (Y/N?
During the update, the SFS installs new protocol updates. If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. After the installation is complete, services are restarted and the user interface is available.
Note: By default, agents request configuration updates every 10 minutes if the WinCollect agent has Enable Automatic Updates set to true.
Administrators should wait for the WinCollect agent to update the remote Windows host with the latest software. In smaller deployments, updates should only take a few minutes, however, larger WinCollect deployments might take an hour or two to fully update.
Verifying that updates are complete
To verify that agents are updated, administrators can log in to the QRadar user interface and review the agent list to verify that agents with updates enabled display 7.2.6 in the Version column. If after a few hours there are WinCollect agents that still show 7.2.2, administrators can review the troubleshooting section below to force an update on any remaining WinCollect agents stuck at a previous version.
Files packaged in the 730_QRadar_wincollectupdate-184.108.40.206.sfs bundle
Files packaged in the 720_QRadar_wincollectupdate-220.127.116.114.sfs bundle
Where do I find more information?
If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:
- Online QRadar Customer Forums
- Submit and manage your support tickets online 24x7 using IBM Service Request
- QRadar Downloads - IBM Fix Central
- IBM Security Support YouTube channel: http://www.youtube.com/user/IBMSecuritySupport
10 May 2019