Troubleshooting
Problem
Is there a way to only allow updates for specific WinCollect agents in my Windows network?
Environment
Yes, if an administrator has a system that is a sensitive asset or a critical business server, they can prevent the Console from sending WinCollect agent updates to specific servers.
When a WinCollect agent RPM or SFS file is installed on the Console, the system creates an update package for the WinCollect Agents. The update package can contain both WinCollect agent software updates and any configuration updates for WinCollect log sources. The Console communicates these changes over port 443 or 8413, depending on your WinCollect version.
If automatic updates are enabled for a WinCollect agent, the Console sends the update package to the remote Windows system where the file is unpacked and installed on the remote host.
When a WinCollect agent RPM or SFS file is installed on the Console, the system creates an update package for the WinCollect Agents. The update package can contain both WinCollect agent software updates and any configuration updates for WinCollect log sources. The Console communicates these changes over port 443 or 8413, depending on your WinCollect version.
If automatic updates are enabled for a WinCollect agent, the Console sends the update package to the remote Windows system where the file is unpacked and installed on the remote host.
Diagnosing The Problem
Administrators can determine if their WinCollect agent is configured for automatic updates from the Admin tab of the Console. The Enable Automatic Updates column determines what agents receive software and log source updates.
- When Enable Automatic Updates column = False, the WinCollect agent is not updated by the Console. No software updates or log source configuration changes are passed to the remote WinCollect agent.
- When Enable Automatic Updates column = True, the WinCollect Agents is updated with a new configuration when either a log source update is available or when a software update is available on the Console.
Note: The frequency with which WinCollect Agents request updates from the Console is determined by the Configuration Polling Interval of the WinCollect agent.
Resolving The Problem
To prevent a WinCollect Agents from being updated, administrators can disable agent updates from the Admin tab. This allows administrators to determine what Windows systems receive WinCollect agent updates from the Console after a WinCollect update is applied.
Procedure
- Click the Admin tab.
- Click the WinCollect icon.
- Select one or more WinCollect agent you do not want to automatically update.
Note: Administrators can use Ctrl + click to select multiple WinCollect agents in the user interface. - Click Enable/Disable Automatic Updates.
- Verify the status of the Enable Automatic Updates is False.
Results
Any software updates installed on the Console are not applied to managed WinCollect agents where Enable Automatic Updates = False.
[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"WinCollect","Platform":[{"code":"PF016","label":"Linux"},{"code":"PF033","label":"Windows"}],"Version":"7.1;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
28 April 2021
UID
swg21685330