@Ramil Mammadov A few issues here. First, I would recommend that you post this in the support forum for WinCollect here: https://ibm.biz/wincollectforums for any future questions as it will give us better visibility going forward to your question. There is also a separate forum tag for QRadar CE questions help here, you are asking in a non-support forum currently: https://ibm.biz/qradarceforums.
What to do
You need to test if your Windows Server 2019 host can connect to QRadar. A standard PING test won't work as we disable ICMP by default in QRadar for security purposes. You can enable it, but here is how to test the connection from your Windows host:
PS C:\Users\Administrator> Test-NetConnection -ComputerName {QRadar CE IP address} -Port 8413
- If successful, you'll see:
TcpTestSucceeded
- If it fails, you'll see:
WARNING: Ping to xxx.xxx.xxx.xxx.xxx failed -- Status: TimedOut
If you are still having issues, then do the following:
On your QRadar CE system, complete an Admin > Advanced > Deploy Full Configuration. Wait for this to complete. After it is done, then do an Admin > Advanced > Restart Event Collection Service. This restarts ecs-ec-ingress, which contains all of the protocol code for listening for incoming events off of the wire. If this still doesn't resolve your issue, you might try added an IP tables rule to force port 8413 to listen. We have a support article on the process basics here: https://www.ibm.com/support/pages/qradar-how-edit-iptables-rules-qradar.
If you still have issues after running through what I posted here, ask us in the WinCollect Support Forum (https://ibm.biz/wincollectforums) and we'll do our best to help.
------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com------------------------------