WinCollect: How to restart managed WinCollect agents remotely

Steps

1. Log in to your QRadar console as root.
2. Run this command:

   /opt/qradar/support/all_servers.sh -Ck "cd /store/configservices/wincollect/configserver/; find . -type d -exec touch {}/force.upgrade \;"

   This command runs a script that runs the same command on all hosts, including the console and passive HA nodes, in the deployment. The command adds an empty file named "force.upgrade" into every configuration directory of WinCollect agents that are registered (managed). This command simulates a configuration change. When the agent will check in at the next configuration polling interval, the agent will think that the configuration needs to be updated, which ends in a restart of the Wincollect service on the Windows host.
3. When the agent checks in during the configuration polling interval, the file is expected to be automatically deleted. If the file is still in the configuration directory for an agent that means that there might be a problem with the registration or configuration updates for that agent. (Or - the agent might be registered to another QRadar host.)
4. To monitor restarts of agents, you can trace the Heartbeat events from WinCollect agents in QRadar Log Activity to see events that show the service stopping and starting.
   
   Result: The Wincollect service is successfully restarted on all managed WinCollect agents.