IBM Support

QRadar: WinCollect and support policies

Question & Answer


Question

This article informs administrators about QRadar® Support policies. QRadar Support assists administrators to investigate and correct issues with WinCollect, such as error messages, documentation questions, or troubleshooting. This document outlines out-of-scope work for WinCollect cases and the responsibilities of the QRadar administrator. 

Answer

Responsibilities for WinCollect

WinCollect is a Syslog event forwarder that administrators can use to forward events from Windows™ logs to QRadar®.  Since a single host with WinCollect can forward logs from multiple Windows hosts, administrators might need to reach out to IBM® QRadar® support for assistance when systems stop sending logs. This article explains what assistance can be given to administrators for these issues.

Support type Description Responsibility
WinCollect assistance and error support
Administrators can use QRadar technical support to assist administrators with WinCollect errors or software issues. For example, QRadar Support can:
 
  • Answer questions to confirm or explain WinCollect documentation.
  • Troubleshoot WinCollect when events are not being received by the Console or a collector.
  • Investigate WinCollect errors or behavior not noted in IBM Documentation.
  • Troubleshoot issues migrating a WinCollect host.
  • Assist with a failed installation of WinCollect or Stand alone WinCollect on a Windows host.
  • Help with failed WinCollect upgrades.
  • Troubleshoot a WinCollect Log source when it fails to populate in the Log Source Management App.
 QRadar technical support

To open a case or report a WinCollect issue, contact QRadar technical support
Out-of-scope for QRadar Support
The following activities are considered out-of-scope for technical support. QRadar Support reserves the right to close cases related to the following issues:
  1. Cases on WinCollect installations that do not comply with the supported versions policy.
  2. Support questions or cases related to Microsoft software that is end of life (EoL).
  3. Requests to install WinCollect on your hosts.
  4. Cases to create automated silent installation scripts.
  5. Requests to configure your WinCollect hosts for both Managed or Stand alone WinCollect.
  6. Configuration or security issues related to Windows Event Forwarding (WEF/WEC), also known as Microsoft subscriptions.
  7. Recover lost Authentication tokens.
  8. Support does not complete guided upgrades for WinCollect agents. Upgrade or installation issues must include logs or a relevant error message.
  9. Troubleshoot or resolve internal network issues between a WinCollect host and QRadar such as:
    • Firewall issues
    • Router issues
    • Cables issues
    • Network interface card (NIC) issues
    • Latency issues
Resources:

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"},{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSKMKU","label":"IBM QRadar on Cloud"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
21 March 2024

UID

ibm16497175

Page Feedback