IBM Support

QRadar: Target event collector mismatch for WinCollect log source in the Log Source Management app

Troubleshooting


Problem

When the Target Event Collector is used in the Filter section of the Log Source Management app, sometimes for WinCollect log sources, the selected event collector in the filter does not match the event collector selected in the log source.

Symptom

The event collector on the log source does match the event collector on the Log Source Management app filter.
For example, in this capture, the filter shows eventcollector0 as the event collector for the log source, but in the log source, the event collector assigned is eventcollector107:
image-20230908130252-1

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
11 September 2023

UID

ibm17013905