How To
Summary
You can use the procedure in this technical note to change the WinCollect configuration console data directory. The base path allows administrators to move the default directory that stores incoming events and other files required to process data for WinCollect in scenarios where more storage is required.
Steps
Before you start
You must confirm that you do not have any pending events that need to be forwarded to QRadar from the WinCollect agent. To review for unprocessed events, navigate to the
/%ALLUSERSPROFILE%/WinCollect/Data/Events
directory ensure the size of the directory is 0. If there are evtb files in the directory, they must be 0 byte files. Any data in this directory needs to be processed and forwarded by WinCollect to prevent leaving unprocessed events behind when you move the Configuration Console base path location.
Procedure
The following procedure defines how to move the base configuration path folder in the Advanced Settings for WinCollect 10 agents.
- Log in to the WinCollect 10 agent.
- Click the Settings icon (1).
- To view the Advanced Settings, enable the Advanced UI (2).
- In the Agent Configuration menu, select Advanced Settings.
- Edit the User data directory field to the new directory.
- Administrators must confirm the new User data directory path has enough space to hold the maximum number of events.
- Click Save.
Results
The WinCollect agent service temporarily restarts to load the new settings. After the service starts, the new data directory path is configured, and the next polling interval populates the new directory with unprocessed events.
The WinCollect agent service temporarily restarts to load the new settings. After the service starts, the new data directory path is configured, and the next polling interval populates the new directory with unprocessed events.
Optional
You can change the path by using the following XML file. Change "update_userdatadirectory.xml" to the directory you want to save your WinCollect data. Copy the XML file to the /patch directory and the agent incorporates the new directory path on the next Configuration Polling Interval. Creating an update_userdatadirectory.xml file allows administrators to add a file to the patches directory when more than one WinCollect agent needs a change to the user data directory.
File name: update_userdatadirectory.xml
<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<Update objPath="SystemSettings" setParam="UserData.Location" value="D:\WinCollect\Data\" />
</WinCollectScript>
Figure 1: In this example, the new data directory path is D:\WinCollect\Data.
Related Information
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
02 May 2023
UID
ibm16557098