IBM Support

QRadar: Unable to change the Target Event Collector for syslog log sources due to Log Source Management app changes

Troubleshooting


Problem

The Target Event Collector field is grayed out, users are not able to change it.

Symptom

  • For new syslog log sources, the fields to select event collectors like Target Event Collect is already pre-selected and grayed out:
    image-20240611153353-1
  • For existing syslog log source, when a user tries to edit the collector fields, they are grayed out:
    image-20240611153607-2

Cause

Users are not able to select or change the Target Event Collector due to updates on the Log Source Management app.

Diagnosing The Problem

The Log Source Management app applied this change on the new app version 7.0.9, it is not possible to change the Target Event Collector (TEC) for syslog log sources:

Resolving The Problem

This change was reversed on the Log Source Management app version 7.0.10:

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSVCRO","label":"IBM Security QRadar Suite - SIEM"},"ARM Category":[],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
08 August 2024

UID

ibm17157205

Page Feedback