QRadar: Changing the default WinCollect Agent name results in a log source not being assigned

Resolving The Problem

To resolve this issue there are two possible solutions:

Option 1: Remove white space from the WinCollect Agent name
In some circumstances, the name provided to the WinCollect Agent might be edited. If the updated name contains extra spaces or unsupported characters, then this can break the association between the log source and the agent.

An example of an unsupported agent name might be NetworkA @ WinCollect @ Computername. The default name for WinCollect Agents should be WinCollect @ identifier. If an administrator manually changes the name, it can cause issues in WinCollect.

Procedure
1. Go To the UI > Admin tab > click on the WinCollect tab icon
2. Click on a WinCollect Agent that you cannot add a log source.
   
3. Remove the white space from the Name field after the @ symbol.
   
4. Click Save.
   
   

Procedure
This is intended to force a single WinCollect agent to auto discover without the need to reinstall on the Windows host.
1. Log in to the Windows host as a local administrator.
2. To open the Run menu, press the Windows logo key + R.
3. Type the following: services.msc
4. Click OK.
5. Locate the WinCollect service and click Stop.
6. Navigate to the WinCollect configuration directory: C:\Program Files\IBM\WinCollect\config\
7. Edit install_config.txt.
8. Change the ApplicationIdentifier= field to a new value.
   
   Example of the values in the install_config.txt file.
   
ApplicationIdentifier=J1111143    <---- This is the value to be changed to force the agent to rediscover.
ConfigurationServer=<QRadar appliance IP or hostname>
ConfigurationServerPort=8413
StatusServer=<QRadar appliance IP or hostname>
ApplicationToken=<String with hashed token>
BuildNumber=1018564

   The application identifier can be anything. On my local WinCollect install, it is my PC name as it was automatically populated by the CLI install. The name you provide must be a new name to identify and not a name that has been used during a previous install.
   
   
9. Locate the WinCollect service and click Start.
10. After the WinCollect agent starts, the Configuration Console on the QRadar appliance will think a new agent is trying to auto discover and update the agent list.
11. Edit the log source configuration for any log sources that are associated with the old agent.
12. In the WinCollect Agent list, select the agent that matches the new ApplicationIdentifier entered in step 7.
13. Click Save.
14. Repeat Steps 11 - 13 for any other log sources you need to remap to the correct WinCollect agent.
    
    Note: It might take up to 10 minutes for the WinCollect agent to send the latest log source configuration to the remote Windows host. .
    
    Results
    To verify the log source and WinCollect agent association, the Administrator can select a WinCollect agent from the agent list, then click the Log Sources icon. A log source should now be associated with the agent.
    
    If the WinCollect agent still does not auto discover on the Console when the ApplicationIdentifier has been changed, then a larger installation is occurring and you should consult QRadar Support for assistance.
    
    
-----

Where do you find more information?

---