IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Installing & configuring DLC

    Posted Thu August 13, 2020 11:35 AM

    Hello Community!

    I'm learning about QRadar and at this point I decided to install a DLC to learn about that possibility. The problem is: I can not find in QRadar 7.4.0 where I add that type of element. All documentation I find shows:

    "In the QRadar Log Source Management app, click the navigation menu icon (3 horizontal bars), and then click
    Disconnected Log Collectors > Register Disconnected Log Collector."

    Mine doesn't have this option. I have downloaded and running as TRIAL just to learn.

    Any clues about what I'm missing? Should I install anything before adding DLC to QRadar?

    DLC:
    dlc-service-1.4.0-1.noarch.rpm

    JAVA:
    ibm-java-x86_64-sdk-8.0-6.15.bin

    My LOG management APP:

    QRDR



    Best,



    ------------------------------
    Eduardo Ellery
    ------------------------------


  • 2.  RE: Installing & configuring DLC

    Posted Thu August 13, 2020 12:28 PM
    Answering myself to help other people who could misunderstand how this works!

    I only had to create a new log source "Universal DSM" with protocol type "IBM Qradar DLC Protocol".

    That was the trick.

    Best,
    Ellery

    ------------------------------
    Eduardo Ellery
    ------------------------------



  • 3.  RE: Installing & configuring DLC

    Posted Fri December 04, 2020 10:28 AM
    Hi Eduardo 

    I'm have a similar experience to you but my solution seems to escape me.
    We have Qradar 7.4.0 with a DLC v1.4.0 registered and trying to add a Disconnected Log Collector as a log source in QRadar.
    But I am continually getting a error 'This Disconnected Log Collector does not support the selected protocol.'  regardless of the protocol I choose when adding a single log source. I had also tried your solution with the Universal DSM  and IBM Qradar DLC Protocol but that resulted in the same error message.
    So my question is have you encountered this issue and if so how did you solve it?

    Many thanks

    Richard

    ------------------------------
    richard robinson
    ------------------------------

    Original Message


  • 4.  RE: Installing & configuring DLC

    Posted Wed September 22, 2021 09:14 AM
    Hi Richard,

    Just wondering did you ever get to resolve the above issue when adding a DLC logsource as I am experiencing a similar issue.

    Many Thanks,

    Shingi

    ------------------------------
    Shingirai Marikasi
    ------------------------------

    Original Message


Related Content