Troubleshooting
Problem
After an upgrade of the WinCollect (SFS) a communication issue can cause a timeout error to occur, which requires the administrator to intervene to allow the update to proceed.
Cause
Possible communication problems between the agent and ecs component.
Diagnosing The Problem
WinCollect upgrade on the agents can fail some times with the following error message in WinCollect system logs:
2016-04-06 15:25:40,686 ERROR System.ConfigurationPatchStrategy : RetrieveSoftwareUpdate: An error occured when attempting to retrieve the software update from the server: Code: 0x80000004 Reason: The configuration server did not respond within a reasonable amount of time or the connection was terminated unexpectedly
Resolving The Problem
During the WinCollect upgrade procedure, the QRadar appliance responsible for managing the remote agent will prepare an upgrade package for the remote Windows host. If for some reason the upgrade package is corrupted, the files in the Staging directory of WinCollect will need to be manually deleted. Then the administrator needs to remove the AgentRC.txt file, which is created when an upgrade issue occurs. After the WinCollect service is restarted, the QRadar appliance will create a new upgrade package for the Windows host to attempt to upgrade it a second time.
Procedure
Procedure
- Log in to the WinCollect agent where the upgrade did not appear to complete.
In these cases, the Agent list in the QRadar user interface will show the older version after some agents have been updated. - Click Start > Run.
- Type services.msc, then click OK.
- Stop WinCollect service.
- Delete the contents of the WinCollect's staging directory C:\Program Files\IBM\WinCollect\staging.
- Navigate to the WinCollect config directory: C:\Program Files\IBM\WinCollect\config.
- Review and delete the file name AgentRC.txt.
- Return to the Service window.
- Start the WinCollect service.
Results
After the WinCollect service restarts, the QRadar appliance will attempt to upgrade the remote Windows host.
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF033","label":"Windows"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
17 August 2020
UID
swg21982525