Troubleshooting
Problem
There can be duplicate entries in the ale_destinations table in QRadar and in the AgentConfig.xml of the WinCollect agent in managed WinCollect deployments. This behavior causes the agent to not send events.
Cause
This issue can be caused by deleting and readding hosts in QRadar.
Diagnosing The Problem
- Log in to Console as the root user.
- Review the output ale_destinations table for duplicate entries by using the following command:
psql -U qradar "select * from ale_destination;"
89 eventcollector404 :: EC404 :: UDP 89 89 192.168.404.xx 514 UDP \N t f t 30000 4000 90 eventcollector404 :: EC404 :: TCP 90 90 192.168.404.xx 514 TCP \N t f t 30000 4000 235 eventcollector404 :: EC404 :: UDP 235 235 192.168.404.xx 514 UDP t f t 30000 4000 135 eventcollector404 :: EC404 :: TCP 135 135 192.168.404.xx 514 TCP t f t 30000 4000
Resolving The Problem
Users can create a destination with a new name and point the agents to that new destination. The initial name used cannot be used again. For more information, see IJ32028: WINCOLLECT LOG SOURCE MANAGEMENT DISPLAYS MULTIPLE INCORRECT ENTRIES WHEN A MANAGED HOST IS REMOVED AND ADDED BACK.
WinCollect 10
Before you start, create a new destination
- From the menu, select Destinations.
- Select Add.
- Create and Save the new destination.
Edit the WinCollect log source to use the new Target Destination in WinCollect 10
- From the menu, select Local Sources or Remote Sources based on which source you are using
- Click the source's Name to edit it.
- Select the old target's checkbox and click Delete to remove the old destination
- Click to Add a new target.
- Select the new Destination and Save.
- Open the notifications window.
- Click Apply Changes.
Result
The agent sends events to the new destination.
WinCollect 7
Before you start, create a new destination
- In the Admin menu, open the WinCollect Configuration Console.
- Go to the Destinations tab and select Add.
- Enter your destination details and select Save.
Edit the WinCollect log source to use the new Target Destination in WinCollect 7
- In the Admin menu, open the WinCollect Configuration Console.
- Click Agents and select the agent you want to edit.
- Click Log Sources and navigate to the Log Sources setting.
- Select the log source you want to edit, and click Edit.
- Select the Target External Destinations check box.
- Select the Target External Destination you want to target.
- Click Save.
Result
The agent sends events to the new destination.
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]
Was this topic helpful?
Document Information
Modified date:
29 April 2022
UID
ibm16561919