IBM Support

WinCollect 7: Managed Agents show with Unavailable status but logs appear correctly in the QRadar Console

Troubleshooting


Problem

In the QRadar Console, the IBM WinCollect 7 Managed Agent's status can be seen fluctuating between 'Running' and 'Unavailable', but agent logs are displaying in the Log Activity tab.

Symptom

The status of the IBM WinCollect 7 Managed Agents can be seen in the WinCollect category in the Data Sources section.
  1. Log in to the QRadar Console.
  2. Click Admin.
    QRadarMain
     
  3. In the Data Sources section. Click WinCollect.
    WinCollect
The IBM WinCollect 7 Managed Agents status can be seen fluctuating between 'Running' and 'Unavailable'.
WinCollectStatus

Cause

An offset in the time between the Event Collector (EC) and the QRadar Console can cause a disruption recognizing the status of the IBM WinCollect 7 Managed Agents.

Environment

IBM WinCollect 7 Managed Agents.

Resolving The Problem

To resolve this issue, the time on the Event Collector (EC) and the QRadar Console are required to be in sync.
To synchronize the Event Collectors (EC) time against the QRadar Console so both servers display the same time, complete the following steps:
  1. Log in to the Event Collector (EC) as the root user.
  2. To synchronize the time between the Event Collector (EC) and the QRadar Console, run the following command: 
    /usr/bin/tlsdate -P sslv23 -s -V -v -H <QRadar_Console_ip> -w
    Note: Change <QRadar_Console_ip> to the actual IP Address for your QRadar Console.
The times on the Event Collector (EC) and the QRadar Console are now synchronized. If you are still noticing the IBM WinCollect 7 Managed Agents status fluctuating between 'Running' and 'Unavailable', contact support.

Related Information

WinCollect 101

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
13 September 2022

UID

ibm16618321

Page Feedback