Release of WinCollect Agent 7.2.2-2

Content

A new SFS file has been posted to IBM Fix Central for WinCollect Agent version 7.2.2-2. This update resolves two critical issues reported in the WinCollect 7.2.2-1 release.

How to upgrade a WinCollect deployment to version 7.2.2-2

To upgrade to WinCollect 7.2.2-2, the administrator only needs to install the SFS file on the QRadar Console appliance. The SFS contains protocol updates and WinCollect Agent software to remotely update Windows hosts with WinCollect 7.2.2-2.

How to complete a fresh install of WinCollect 7.2.2-2

Administrators with WinCollect Agent version 7.1.1 must ensure that port 8413 is open, then reinstall the WinCollect Agent on their Windows systems. The WinCollect Agent 7.2.2-2 (sfs) file must be installed on the QRadar Console before installing the EXE file on the Windows host. Any WinCollect Agents that have Enable Automatic Updates column set to True will receive the WinCollect Agent 7.2.2-2 software update from the Console.

Before you begin

• To avoid access errors in your log file, close all open QRadar sessions.
• Verify that all changes are deployed on your appliances.
• Installing the SFS file forces a Tomcat restart on the Console, which will log out QRadar users and stop any reports running in the background. Administrators should be aware of this service restart to schedule maintenance time appropriately.
• Installing the SFS file forces a restart of the WinCollect service on the remote Windows host. When the WinCollect Service restarts, there is no loss in event data from your Windows systems and no operating system impact.
• It is possible for the administrator to prevent a software update to a critical business asset or server from the WinCollect agent list on the Admin tab. The Enable Automatic Updates field must be set to false before you install a RPM or SFS file to the Console to prevent a system from being updated. For more information, see http://www.ibm.com/support/docview.wss?uid=swg21685330.
• The WinCollect Agent SFS file can only be installed on the QRadar Console appliance. Installing the WinCollect Agent update SFS on a managed hosts will display an error message to the administrator.

About this task

Procedure

1. Download a WinCollect Agent (v7.2.2-2) bundle (.SFS) from the IBM Fix Central website for your QRadar version:
   
• QRadar 7.1: WinCollect Agent 7.2.2-2 (SFS for QRadar 7.1.x)
• QRadar 7.2: WinCollect Agent 7.2.2-2 (SFS for QRadar 7.2.x)
  
  **IMPORTANT: New deployments must have the SFS file installed on the Console before the WinCollect 7.2.2 Agent EXE is installed on the Windows host. Administrators should install the SFS file on the Console first to prevent an encryption key issue that can occur.
  
2. Using SSH, log in to your Console as the root user.
3. Copy the fix pack to the /tmp directory on the QRadar Console.
   Note: If space in the /tmp directory is limited, copy the fix pack to another location that has sufficient space.
4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
5. Change to the directory where you copied the patch file. For example, cd /tmp
6. To mount the patch file to the /media/updates directory, type the following command:
   mount -o loop -t squashfs 7x0_QRadar_wincollectupdate-7.<version>.sfs /media/updates
7. To run the patch installer, type the following command:
   /media/updates/installer
   
   NOTE: To proceed with the WinCollect Agent update services need to be restarted on QRadar to apply protocol updates. This The following message is displayed:
   
   WARNING: Services need to be shutdown in order to apply patches. This will cause an interruption to data collection and correlation.
   
   Do you wish to continue (Y/N?
   
   
8. To continue with the update, type Y to continue.
   
   During the update, the SFS installs new protocol updates. If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. After the installation is complete, services are restarted and the user interface is available.
   
9. Log in to QRadar and review the agent list to verify that agents with updates enabled display 7.2.2 in the Version column and that events are being received by QRadar.
   
   Note: By default, agents request configuration updates every 10 minutes if the WinCollect agent has Enable Automatic Updates set to true.
   

A summary of the installation advises you of any issues that occurred during the install.

WinCollect RPMs contained in the SFS installer