Release of WinCollect Agent 7.2.5

Content

Quick links

• About WinCollect v7.2.5: Fixed issues list
• Prerequisites for the WinCollect Upgrade
• How to upgrade to WinCollect v7.2.5
• WinCollect RPMs contained in the SFS installer

About WinCollect v7.2.5: Fixed issues list

A new SFS file has been posted to IBM Fix Central for WinCollect Agent version 7.2.5. This update resolves multiple issues reported in the previous WinCollect release. This release does not include any new features as the WinCollect 7.2.5 release contains only resolutions for reported defects. Questions about this version / upgrade can be discussed in our new WinCollect forums here: WinCollect / Windows Event Collection forum.

NOTE: Due to QRadar 7.1.x being end of engineering, there is no WinCollect 7.1.x SFS file being released to upgrade to WinCollect 7.2.5. Administrators interested in installing WinCollect 7.2.5 must upgrade their QRadar deployment to the QRadar 7.2 software version. No QRadar 7.1.x upgrade files are being offered to upgrade to WinCollect 7.2.5.

WinCollect 7.2.5 supports event collection from the following Windows operating systems. For more information, see the WinCollect Use Guide.

• Windows Server 2016
• Windows Server 2008 (most recent)
• Windows Server 2008 Core
• Windows Server 2012 (most recent)
• Windows Server 2012 Core
• Windows 7 (most recent)
• Windows 8 (most recent)
• Windows 10 (most recent)
• Windows Vista (most recent)

Prerequisites for the WinCollect Upgrade

Installation pre-requisites

QRadar Version	Minimum WinCollect Version	RPM Minimum Version
QRadar 7.2.x (any patch level)	WinCollect 7.2.2-2	AGENT-WINCOLLECT-7.2-1018607.noarch

To verify you meeting the minimum requirements:
1. Log in to the QRadar Console.
2. From the Navigation bar, click Help > About.
3. Click Additional Information and verify you have the base software and RPM versions installed.




Before you begin

• To avoid access errors in your log file, close all open QRadar sessions.
• Verify that all changes are deployed on your appliances.
• Installing the SFS file forces a Tomcat restart on the Console, which will log out QRadar users and stop any reports running in the background. Administrators should be aware of this service restart to schedule maintenance time appropriately.
• It is possible for the administrator to prevent a software update to a critical business asset or server from the WinCollect agent list on the Admin tab. To prevent a host from being updated, the Enable Automatic Updates field must be set to false before you install the SFS file to the Console. For more information, see http://www.ibm.com/support/docview.wss?uid=swg21685330.
• The WinCollect Agent SFS file can only be installed on the QRadar Console appliance. Installing the WinCollect Agent update SFS on a managed hosts will display an error message to the administrator.

WinCollect upgrade procedure

This section outlines how to install WinCollect 7.2.5 on the QRadar Console. The WinCollect update only needs to be installed on the QRadar Console. The Console appliance will replicate all required files to other QRadar appliances in the deployment.

To upgrade existing WinCollect agents, the administrator must to install the SFS file on the QRadar Console appliance. The SFS contains protocol updates and WinCollect Agent software to remotely update Windows hosts with WinCollect 7.2.5.

Step 1

Step 2

Install the proper file on your QRadar Console. The procedure below outlines in installation steps for administrators. For QRadar 7.2.x Consoles: 720_QRadar_wincollectupdate-7.2.0.445.sfs NOTE: Due to QRadar 7.1.x being end of engineering, there is no WinCollect 7.1.x SFS file being released to upgrade to WinCollect 7.2.5. Administrators interested in installing WinCollect 7.2.5 must upgrade their QRadar deployment to the QRadar 7.2 software version. No QRadar 7.1.x upgrade files are being offered to upgrade to WinCollect 7.2.5.

Wait for installs to complete and update the user interface to WinCollect 7.2.5.

Procedure
These instructions are intended for standard upgrades of WinCollect. If you are using 'Stand-alone' mode, you must download and install the WinCollect Standalone Patch Installer 7.2.5 for each Windows host to upgrade your agents. The instructions provided below are for managed WinCollect installations.


1. Download a WinCollect Agent (v7.2.5) bundle (.SFS) from the IBM Fix Central website for your QRadar version: 720_QRadar_wincollectupdate-7.2.0.445.sfs
   
   Note: The installation process will restart services on the Console, which will create a gap in event collection until services restart. Administrators should be aware of the service restart so they can schedule their upgrades during a maintenance window.
   
   
2. Using SSH, log in to your Console as the root user.
3. Copy the fix pack to the /tmp directory on the QRadar Console. If space in the /tmp directory is limited, copy the fix pack to another location that has sufficient space.
4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
5. Change to the directory where you copied the patch file. For example, cd /tmp
6. To mount the patch file to the /media/updates directory, type one of the following commands: mount -o loop -t squashfs 720_QRadar_wincollectupdate-7.2.0.445.sfs /media/updates
7. To run the patch installer, type the following command: /media/updates/installer
   
   NOTE: To proceed with the WinCollect Agent update services need to be restarted on QRadar to apply protocol updates. This The following message is displayed:
   
   WARNING: Services need to be shutdown in order to apply patches. This will cause an interruption to data collection and correlation.
   
   Do you wish to continue (Y/N?
   
   
8. To continue with the update, type Y to continue.
   
   During the update, the SFS installs new protocol updates. If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. After the installation is complete, services are restarted and the user interface is available.
   
   Note: By default, agents request configuration updates every 10 minutes if the WinCollect agent has Enable Automatic Updates set to true.
   
   



Results
Administrators should wait for the WinCollect agent to update the remote Windows host with the latest software. In smaller deployments, updates should only take a few minutes, however, larger WinCollect deployments might take an hour or two to fully update.



Verifying that updates are complete
To verify that agents are updated, administrators can log in to the QRadar user interface and review the agent list to verify that agents with updates enabled display 7.2.5 in the Version column.

WinCollect RPMs contained in the SFS installer

AGENT-WINCOLLECT-7.2-20161123160813.noarch.rpm

PROTOCOL-WinCollectConfigServer-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectFileForwarder-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectJuniperSBR-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftDHCP-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftDNS-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftIAS-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftIIS-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftISA-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectMicrosoftSQL-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectNetAppDataONTAP-7.2-20161123160813.noarch.rpm
PROTOCOL-WinCollectWindowsEventLog-7.2-20161123160813.noarch.rpm

---

Where do I find more information?
If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:

• Online QRadar Customer Forums
• Submit and manage your support tickets online 24x7 using IBM Service Request
• QRadar Downloads - IBM Fix Central
• IBM Security Support YouTube channel: http://www.youtube.com/user/IBMSecuritySupport