IBM Support

Wincollect: How to modify the WinCollect 7 local cache folder

Question & Answer


Question

How can I modify the WinCollect 7 local cache folder?

Cause

WinCollect uses the %ALLUSERSPROFILE%\WinCollect\Data folder by default to store events in local cache. In some cases, under different circumstances the drive where the local cache folder is located can run out of space. Users can change the location of the local cache folder to another drive or folder.

Answer

The steps to change the local cache folder can vary depending on the type of WinCollect agent installed.  Below you can find the steps for Managed and Standalone agents. Before changing the local cache folder take in consideration that the new location has enough space available based on the Disk Cache Capacity configured.
Managed Agents
  1. Login to the QRadar Admin UI and go to the WinCollect list of agents.
  2. Select the WinCollect agent where you want to modify the local cache folder.
  3. Double click or click Edit in the selected agent.
  4. In the WinCollect Configuration section modify the Disk Cache root directory to the desired location.
    image-20220809135156-2
  5. Click Save changes.

    Result
    Wait for the next Configuration Poll interval for the agent to apply the changes and it will start and use the new local cache folder configured.
Standalone Agents
  1. Open the WinCollect Configuration Console.
  2. Go to Global Configuration > Disk Manager.
  3. Change the Base Path parameter to the desired location.
    image-20220813131829-1
  4. Deploy changes

    Result
    Wait for the next Configuration Poll interval for the agent to apply the changes and it will start and use the new local cache folder configured.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
02 May 2023

UID

ibm16611245