IBM Support

QRadar: WinCollect 10 console is unable to open - error: ERR_CONNECTION_REFUSED

Troubleshooting


Problem

WinCollect 10 console won't open when you start it from the Start-menu, and displays a connection error.

Symptom

WinCollect 10 console displays a connectivity-related error similar to the following (depending on your browser):

Wincollect outage

Cause

When you open the WinCollect console and see previously mentioned error - common causes are that the port is engaged by another service, or that the port is restricted.

Diagnosing The Problem

  1. Login to the WinCollect host (Windows® host).
  2. Open File Explorer and navigate to the installation directory of WinCollect. This is by default in: C:\Program Files\IBM\WinCollect\config.
  3. Open AgentConfig.xml in an editor (Notepad or Winword or Notepad++) and look for the Console.Port value. 
    <WinCollectConfiguration xmlns="event_collection/WinCollect" version="10.1.10">
<AgentCore Name="...
.
.
.
<SystemSettings>
<Parameter name="Console.Port" value="3001"/>
.
.
.
</SystemSettings>
</WinCollectConfiguration>
  4. If the default port has been changed from the default (3000), you will see this Parameter in the AgentConfig.xml file. If the line mentioning Console.Port is not present, it means that the port has not been changed from default.

Resolving The Problem

If you are unable to open the WinCollect console and want to try another port, you need to edit the file AgentConfig.xml manually.
​
  1. Login to the WinCollect host.
  2. Open File Explorer and navigate to the installation directory of WinCollect. This is by default in: C:\Program Files\IBM\WinCollect\config.
  3. Open AgentConfig.xml in an editor (for example Notepad, Wordpad or Notepad++) and look for the Console.Port value. If it's not visible, you can add it according to the following model. If the default port 3000 is engaged, use the next available port, like for example 3001. 
    <WinCollectConfiguration xmlns="event_collection/WinCollect" version="10.1.10">
<AgentCore Name="...
.
.
.
<SystemSettings>
<Parameter name="Console.Port" value="3001"/>
.
.
.
</SystemSettings>
</WinCollectConfiguration>
  4. Save the file and restart the WinCollect service from Task Manager or from Services in Windows.
Result: The WinCollect console should now be running on a different local port.
Dashboard

Changing the port from the GUI

When the WinCollect console is finally running, you can change the port from the GUI:

  1. Click the cogwheel icon at the top-right of the console window.
  2. Enable Advanced UI.
  3. Click the ☰ menu at the top-left of the console.
  4. Select Advanced Settings. 
  5. Now you can see the same value as set in the AgentConfig.xml file:
    image-20240902140602-1
  6. Make any changes and click Save at the bottom of the screen.
  7. You will be prompted to deploy changes.
  8. The console will restart and use the new port value.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
02 September 2024

UID

ibm17161422

Page Feedback