IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

WinCollect 10 and the Forward File Log Source Type

  • 1.  WinCollect 10 and the Forward File Log Source Type

    Posted 05/24/23 08:22 AM

    Hello Folks,

    I'm having trouble with WinCollect and getting events back to QRadar.  We have a host that I use as a log aggregator.  Its a Windows Server 2016 and has the latest WinCollect v.10 on it.  The issue is that the normal Windows logs (Application, Security and System) all flow back to QRadar nicely but I also have 3 Forward File Log Sources that don't work correctly.  They fail because I'm using the same Log Source Identifier, the host name, on all three.  Monitoring my Log Sources I only get one of them working at a time.  This failure aligns with the thought that Log Source Identifiers have to be unique.  Is that true?  And if it is, How can I configure my Log Sources so they work?  Sadly all worked perfectly with WinCollect v.7.  FYI we're using QRadar v.7.5.0.

    One last thing, if I do use unique Log Source Identifiers for them all the events arrive at QRadar but I can't get them to use my custom DSMs.  They all get tagged as "unknown".

    TL;DR - Mixing log source types using WinCollect v.10 doesn't work for me.

    Thanks and Kind Regards,
    -Bill



Related Content