IBM Support

WinCollect: How to change the WinCollect base path

How To


Summary

You can use the procedure in this technical note to change the WinCollect configuration console data directory. The base path allows administrators to move the default directory that stores incoming events and other files required to process data for WinCollect in scenarios where more storage is required.

Steps

Before you start
You must confirm that you do not have any pending events that need to be forwarded to QRadar from the WinCollect agent. To review for unprocessed events, navigate to the /%ALLUSERSPROFILE%/WinCollect/Data/Events directory ensure the size of the directory is 0. If there are evtb files in the directory, they must be 0 byte files. Any data in this directory needs to be processed and forwarded by WinCollect to prevent leaving unprocessed events behind when you move the Configuration Console base path location.


Procedure

The following procedure defines how to move the base configuration path folder in the Advanced Settings for WinCollect 10 agents.

  1. Log in to the WinCollect 10 agent.
  2. Click the Settings icon (1).
  3. To view the Advanced Settings, enable the Advanced UI (2).
  4. In the Agent Configuration menu, select Advanced Settings.
  5. Edit the User data directory field to the new directory.
  6. Administrators must confirm the new User data directory path has enough space to hold the maximum number of events.
  7. Click Save.
Results
The WinCollect agent service temporarily restarts to load the new settings. After the service starts, the new data directory path is configured, and the next polling interval populates the new directory with unprocessed events.
Optional
You can change the path by using the following XML file. Change "update_userdatadirectory.xml" to the directory you want to save your WinCollect data. Copy the XML file to the /patch directory and the agent incorporates the new directory path on the next Configuration Polling Interval. Creating an update_userdatadirectory.xml file allows administrators to add a file to the patches directory when more than one WinCollect agent needs a change to the user data directory.

File name: update_userdatadirectory.xml

<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<Update objPath="SystemSettings" setParam="UserData.Location" value="D:\WinCollect\Data\" />
</WinCollectScript>

Figure 1: In this example, the new data directory path is D:\WinCollect\Data.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
02 May 2023

UID

ibm16557098

Page Feedback