Release of the Stand-alone Patch Installer (WinCollect Configuration Console)

Content

Quick links

• What is the WinCollect Stand-alone Patch Installer?
• Should I install the Stand-alone Patch Installer (WinCollect Configuration Console)?
• New features
• Installation instructions
• Troubleshooting

What is the WinCollect Stand-alone Patch Installer?

• Patch the local WinCollect agent to the latest software version (7.2.2-2)
  
  or
• Patch the local WinCollect agent to the latest software version (7.2.2-2) and also install the latest WinCollect Configuration Console user interface.
  
  Important: At minimum, the WinCollect Stand-alone patch installer will upgrade the existing WinCollect agent software to the latest version (WinCollect 7.2.2-2). There is no method to disable the upgrade option. If you do not want to upgrade your unmanaged WinCollect agents, then you should not install the Stand-alone Patch Installer.

Should I install the Stand-alone Patch Installer (WinCollect Configuration Console)?

The Stand-alone Patch Installer (WinCollect Configuration Console) is intended only for WinCollect agents that have been configured in stand-alone / unmanaged mode. Stand-alone / unmanaged WinCollect agents have the management communication on TCP port 8413 between the Console and the WinCollect agents stopped on purpose, which allows the WinCollect agent to act as a stand-alone event forwarder for Windows. The WinCollect agents in this mode can still remotely poll Windows hosts for events, however, the centralized management feature from the QRadar appliance is disabled.

If a WinCollect agent is still managed by the QRadar appliance, then the setup file halts the installation. The WinCollect agents must be unmanaged before the installation of the WinCollect Configuration Console (Stand-alone Patch Installer) begins.

New features

Installation features


• The installer can now upgrade an existing unmanaged/standalone WinCollect agents while keeping the existing log source configuration intact.
  
  At install time, the WinCollect agent software on the Windows host is updated to the latest version. Administrators have the option to also install the latest version of the WinCollect Configuration Console user interface.
  
  Note: The WinCollect Stand-alone Patch Installer cannot create log sources automatically, like the WinCollect Setup file. This installer is intended to patch existing unmanaged WinCollect installations and provide an updated Configuration Console user interface.
• A silent install option is now available for administrators. There are a few different silent install options:
1. Full install, which upgrades the WinCollect agent and installs the latest WinCollect Configuration Console:
   WinCollect_Standalone_Patch_Installer_Setup_7_2_2_1018564.exe /s /v" /qn"
2. To upgrade the WinCollect agent only (skips the WinCollect Configuration Console UI install):
   WinCollect_Standalone_Patch_Installer_Setup_7_2_2_1018564.exe /s /v" /qn ADDLOCAL=WinCollect_StandAlone_Patch"
3. To set an installation path: WinCollect_Standalone_Patch_Installer_Setup_7_2_2_1018564.exe /s /v" /qn ADDLOCAL=ALL INSTALLDIR=<PATH>"
   
   Note: If the install fails, there is a known issue with the INSTALLDIR parameter that can cause MSI script 1720 error messages. Administrators can work around this issue and complete the install without using the INSTALLDIR parameter. For more information, see APAR IV76915.
   
   
WinCollect Configuration Console features


• All WinCollect plug-ins are now supported by the WinCollect Configuration Console. Administrators can now edit and save Microsoft SQL, IIS, DHCP, Juniper Steel-Belted Radius, Microsoft IAS/NPS, Microsoft ISA, and NetApp Data ONTAP log sources using the WinCollect Configuration Console.
• A new credentials interface allows administrators to store credentials on the WinCollect agent and use the stored credentials when configuring log sources in the WinCollect Configuration Console.
• The user interface of the WinCollect Configuration Console has been updated to remove unnecessary fields.

Installation instructions

The following instructions guide administrators through the GUI installation process, however, a silent install option is also available. For information on using the silent install option, see the WinCollect User Guide.

Before you begin
1. Administrators must uninstall any older versions of the WinCollect Configuration Console on the Windows host. If an older version of the WinCollect Configuration Console has not been uninstalled prior to starting the patch installer, the following error is displayed:
   
2. The existing WinCollect agent must be in stand-alone mode before the installation can begin. If the agent is in managed mode at installation time, the following error is displayed:
   
   
   

Prerequisites
• .NET framework 3.5 features are required. For information on how to verify .NET installations, see https://www.ibm.com/support/docview.wss?uid=swg21701063
• Microsoft Management Console (MMC) 3.0 and later is required.
  


Supported software versions
The WinCollect Stand-alone Patch Installer has been validated to install properly on the following Windows software versions:

• Windows Server 2008 (most recent)
• Windows Server 2012 (most recent)
• Windows 7 (most recent)
• Windows 8 (most recent)
• Windows Vista (most recent)
  

Procedure
1. Download the WinCollect Stand-alone Patch Installer (.exe) from the IBM Fix Central website: https://ibm.biz/BdXRNW
2. Copy the WinCollect Stand-alone Patch Installer to the Windows host.
3. To install the WinCollect Stand-alone Patch Installer, double-click on WinCollect_Standalone_Patch_Installer_Setup_7_2_2_1018564.exe
4. If you are not on the latest WinCollect version, click Yes to confirm the upgrade text.
   
   Note: Administrators only see this prompt when they are not on WinCollect agent version 7.2.2-2. To halt the installation and prevent your WinCollect agents from being updated to WinCollect agent version 7.2.2-2, click No.
   
5. Click I accept the terms in the license agreement to continue the installation.
6. Type a User Name and Organization for the installer and click Next.
7. Select the features to install and click Next.
• By default, both the WinCollect Patch to upgrade the agent software and the WinCollect Configuration Console are selected to be installed:
  
• To only install the WinCollect Stand-alone Patch to upgrade your WinCollect agents to 7.2.2-2, administrators must disable the Configuration Console as shown below:
  
  
8. Click Install to continue.
9. Click Finish to complete the installation.
   



Results

The software is installed based on the selected options. If the administrators installed the WinCollect Configuration Console, then they can launch the software from the Start Menu > All Programs > IBM > WinCollect Configuration Console. The administrator can use the WinCollect Configuration Console to edit or configure new log sources for the unmanaged WinCollect agent.

Troubleshooting the installation


If the silent installer does not complete an install, the administrator can replace the /qn flag with /qb, which will display any installation error messages on screen for the remote Windows host. For example:
WinCollect_Standalone_Patch_Installer_Setup_7_2_2_1018564.exe /s /v" /qb ADDLOCAL=ALL

If the installer generates a 1720 error, this issue can be cause by using the INSTALLDIR variable as described in APAR IV76915 or can also be due to the lack of the WinCollect agent not having a Status Server value in the install_config.txt file.

Important: If the administrator continues to experience installation issues, they can use the guided installer by running the exe file without any special command-line parameters. This launches the user interface installation wizard, which when run as administrator has no known issues.




Procedure
To set the status server field for the WinCollect agent:

1. Log in to the Windows system hosting the WinCollect agent as the local administrator.
2. To open the Run menu, press the Windows logo key + R.
3. Type the following: services.msc
4. Click OK.
5. Locate the WinCollect service and click Stop.
6. Navigate to the WinCollect installation directory. For example, C:\Program Files\IBM\WinCollect\config
7. Edit the following file: install_config.txt
8. Verify that an IP address or host name exists in the STATUSSERVER= field. For example, these are the expected values for an unmanaged install of WinCollect:
   
   ApplicationIdentifier=<computer name or any identifiable value that describes the agent>
   ConfigurationServer=<must be left blank for unmanaged mode>
   ConfigurationServerPort=8413
   StatusServer=<Requires an IP address or hostname>
   ApplicationToken=<Can be blank or contain a string of values for the encrypted auth token>
   BuildNumber=1018564 <WinCollect version identifier>
   
9. Save any changes made to the install_config.txt file.
10. From the Services window, select the WinCollect service and click Start.
11. Reinstall the Stand-alone Patch installer from the command-line or use the installation wizard to complete the install.
    
    Any time an administrator has an unmanaged WinCollect install, it is important to have the STATUSSERVER= field populated with an IP address or hostname. The reason for having a status server is that the agent will generate Syslog event messages to inform administrators of WinCollect issues, like service stopped, service started, authorized token issues, and more.

• Online QRadar Customer Forums
• Submit and manage your support tickets online 24x7 using IBM Service Request
• QRadar Downloads - IBM Fix Central
• IBM Security Support Youtube channel: http://www.youtube.com/user/IBMSecuritySupport