Troubleshooting
Problem
Your deployment may require that the Collector connection point to a processor different from the default. In other instances, when re-adding an Event or Flow Collector back into a deployment, it might need to be modified so that the collector points to the correct Processor.
Resolving The Problem
To resolve this issue.
- Log in to the QRadar UI.
- Open the Admin settings:
- In IBM Security QRadar V7.3.1, click the navigation menu ☰ , and then click Admin to open the Admin tab.
- In IBM Security QRadar V 7.3.2, 7.3.0 or earlier, click the Admin tab.
- Click System and License Management.
- Click an Event Collector or QFlow to highlight the Appliance.
- Click Deployment Actions > Edit Host Connection.
- If the Appliance is a QFlow:
From Modify Flow Collector Connection drop-down menu, choose the Appliance that you want to connect to.
- If the Appliance is an Event Collector:
From the Modify Event Collector Appliance Connection drop-down menu, choose the Appliance that you want to connect to.
Note: The Appliance with the Asterisk * is the Processor with the current Destination Connection. - Click Save.
- From the Admin tab, click Deploy Changes.
Results: The Connection has been Changed.
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"General Information","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.3.x;7.2.8","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
21 January 2021
UID
swg22013969