Release of WinCollect Agent V7.2.8 patch 2

Content

Quick links

• Known issues identified in WinCollect V7.2.8.P2
• About WinCollect v7.2.8.P2
• Prerequisites for the WinCollect upgrade
• How to upgrade to WinCollect v7.2.8.P2
• QRadar 7.2 RPMs contained in the WinCollect SFS installer
• QRadar 7.3 RPMs contained in the WinCollect SFS installer

Known issues identified in WinCollect V7.2.8.P2

There are no known issues specific to WinCollect V7.2.8.P2 at this time.

About WinCollect V7.2.8.P2

This patch release updates the IBM QRadar WinCollect Agent UI to display the build number in the agent. This allows you to easily determine which WinCollect agents are updated. Questions about this version / upgrade can be discussed in our new WinCollect forums here: WinCollect forum.

Features and resolved issues

Supported Windows operating systems

• Windows Server 2016
• Windows Server 2008 (most recent)
• Windows Server 2008 Core
• Windows Server 2012 (most recent)
• Windows Server 2012 Core
• Windows 7 (most recent)
• Windows 8 (most recent)
• Windows 10 (most recent)
• Windows Vista (most recent)
  
  NOTE: WinCollect is not supported on versions of Windows that have been moved to End Of Life by Microsoft. After software is used beyond the Extended Support End Date, the product might still function as expected; however, IBM will not make code or vulnerability fixes to resolve WinCollect issues for older operating systems. For more information, see the WinCollect User Guide.

   

IBM Statement for WinCollect supported versions
Administrators should be aware that supported software versions for IBM WinCollect is the Latest version (n) and latest minus one (n-1). This means that the two newest versions of WinCollect are the versions that QRadar Support will recommend with any support tickets (cases) that are opened. To prevent issues, it is important that administrators keep WinCollect deployments updated when new versions are posted to IBM Fix Central. For questions related to this statement, ask in the WinCollect forum: http://ibm.biz/wincollectforums.

Prerequisites for the WinCollect V7.2.8.P2 upgrade

Installation prerequisites
This table is intended for managed WinCollect agents that receive updates from a QRadar appliance. Stand-alone WinCollect agents can be updated using the 7.2.0-QRADAR-wincollect-standalone-patch-installer-7.2.8-145.exe file to update the agents on Windows host.

Table 1: The WinCollect version for managed agents can be found in the Agent list on the Admin tab.


QRadar version prerequisites
This table is intended to outline WinCollect version requirements for QRadar.

Table 2: The WinCollect version for managed agents can be found in the Agent list on the Admin tab.
 

Before you begin

• To avoid access errors in your log file, close all open QRadar sessions.
• Verify that all changes are deployed on your appliances.
• Installing the SFS file forces a Tomcat restart on the Console, which will log out QRadar users and stop any reports running in the background. Administrators should be aware of this service restart to schedule maintenance time appropriately.
• It is possible for the administrator to prevent a software update to a critical business asset or server from the WinCollect agent list on the Admin tab. To prevent a host from being updated, the Enable Automatic Updates field must be set to false before you install the SFS file to the Console. For more information, see http://www.ibm.com/support/docview.wss?uid=swg21685330.
• The WinCollect Agent SFS file can only be installed on the QRadar Console appliance. Installing the WinCollect Agent update SFS on a managed hosts will display an error message to the administrator.

WinCollect upgrade procedure

This section outlines how to install WinCollect V7.2.8.P2 on the QRadar Console. The WinCollect update needs only to be installed on the QRadar Console. The Console appliance will replicate all required files to other QRadar appliances in the deployment. To upgrade existing WinCollect agents, the administrator must to install the SFS file on the QRadar Console appliance. The SFS contains protocol updates and WinCollect Agent software to remotely update Windows hosts with WinCollect V7.2.8.P2.

NOTE: If you are using 'stand-alone' mode, you must download and install the WinCollect Patch Installer V7.2.8.P2 for each Windows host and install the update locally on each agent. For more information about stand-alone mode, see the WinCollect Guide.

Procedure
These instructions are intended for standard (managed) upgrades of WinCollect. The instructions provided below are for managed WinCollect installations.

1. Download a WinCollect Agent (v7.2.8.P2) bundle (.SFS) from the IBM Fix Central website for your QRadar version:
   • QRadar 7.2.x: 720_QRadar_wincollectupdate-728.145.P2.sfs
   • QRadar 7.3.x: 730_QRadar_wincollectupdate-728.145.P2.sfs
     
     Note: The installation process will restart services on the Console, which will create a gap in event collection until services restart. Administrators should be aware of the service restart so they can schedule the WinCollect upgrade during a maintenance window.
      
2. Using SSH, log in to your Console as the root user. This SFS file is only installed on the QRadar Console. There is no need to install the WinCollect SFS on non-Console appliances.
3. Copy the fix pack to the /tmp directory on the QRadar Console. If space in the /tmp directory is limited, copy the SFS to another location that has sufficient space, such as /root or /storetmp for QRadar 7.3.0 Consoles.
4. To create the /media/updates directory, type the following command: mkdir -p /media/updates
5. Change to the directory where you copied the patch file. For example, cd /tmp
6. To mount the patch file to the /media/updates directory, type one of the following commands:
   • QRadar 7.2.x: mount -o loop -t squashfs 720_QRadar_wincollectupdate-728.145.P2.sfs /media/updates
   • QRadar 7.3.x: mount -o loop -t squashfs 730_QRadar_wincollectupdate-728.145.P2.sfs /media/updates
7. To run the patch installer, type the following command: /media/updates/installer
   
   NOTE: To proceed with the WinCollect Agent update services need to be restarted on QRadar to apply protocol updates. This The following message is displayed:
   
   WARNING: Services need to be shutdown in order to apply patches. This will cause an interruption to data collection and correlation.
   
   Do you wish to continue (Y/N)?
    
8. To continue with the update, type Y to continue.
   
   NOTE: During the update, the SFS installs new protocol updates. If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes. After the installation is complete, services are restarted and the user interface is available.
    
9. WARNING: Patch 144249 includes a new version of the WinCollect Configuration Server. If you do not restart the event collection service, agents cannot get new configurations and code updates.
   Perform one of the following tasks:
   1. Restart event collection service at the end of the patch installation, on the Console and on all managed hosts patched from the Console.
   2. Do not restart event collection service yet. You will need to restart it in the user interface (Advanced > Restart Event Collection Services).
   3. Abort the patch installation.
10. The administrators can delete the WinCollect update SFS file from the QRadar Console.
11. To unmount the SFS file from the Console, type the following command: umount /media/updates
12. (Optional) If you selected option #2 in Step 9, select Advanced > Restart Web Server on the Admin tab.

Results
Administrators should wait for the WinCollect agent to update the remote Windows host with the latest software. In smaller deployments, updates should only take a few minutes, however, larger WinCollect deployments might take an hour or two to fully update. By default, agents request configuration updates every 10 minutes if the WinCollect agent has Enable Automatic Updates set to true.

Administrators can log in to the QRadar user interface and review the agent list to verify that agents with updates enabled display 7.2.8.P2 in the Version column. After one hour of time has passed, the administrator can review if any WinCollect agents that still show older agent versions in the QRadar user interface. If the QRadar Console is at QRadar V7.2.8 Patch 7 or later and you are attempting to upgrade from WinCollect V7.2.2-2 to WinCollect V7.2.4, you might be experiencing the upgrade issue outlined here: IV99280.

QRadar 7.2 RPMs contained in the WinCollect SFS installer

The following RPM files are contained within the WinCollect V7.2.8.P2 SFS file. When the WinCollect SFS file is installed on the Console appliance, the following RPM files are installed. This information is intended for reference only. Administrators should never attempt to install these RPMs themselves, instead contact QRadar Support for any installation issues.

•    DSM-WinCollect-7.2-922053.noarch
•    PROTOCOL-WinCollectMicrosoftISA-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftDNS-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftDHCP-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectNetAppDataONTAP-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftIAS-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectFileForwarder-7.2-20181212142622.noarch
•    AGENT-WINCOLLECT-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectWindowsEventLog-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectJuniperSBR-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftSQL-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectConfigServer-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftExchange-7.2-20181212142622.noarch
•    PROTOCOL-WinCollectMicrosoftIIS-7.2-20181212142622.noarch

QRadar 7.3 RPMs contained in the WinCollect SFS installer

The following RPM files are contained within the WinCollect V7.2.8.P2 SFS file. When the WinCollect SFS file is installed on the Console appliance, the following RPM files are installed. This information is intended for reference only. Administrators should never attempt to install these RPMs themselves, instead contact QRadar Support for any installation issues.

• DSM-WinCollect-7.3-20160908133313.noarch
• PROTOCOL-WinCollectMicrosoftDNS-7.3-20181212142622.noarch
• PROTOCOL-WinCollectConfigServer-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftISA-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftExchange-7.3-20181212142622.noarch
• PROTOCOL-WinCollectJuniperSBR-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftDHCP-7.3-20181212142622.noarch
• PROTOCOL-WinCollectWindowsEventLog-7.3-20181212142622.noarch
• AGENT-WINCOLLECT-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftIAS-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftIIS-7.3-20181212142622.noarch
• PROTOCOL-WinCollectFileForwarder-7.3-20181212142622.noarch
• PROTOCOL-WinCollectMicrosoftSQL-7.3-20181212142622.noarch
• PROTOCOL-WinCollectNetAppDataONTAP-7.3-20181212142622.noarch