Hi,

I am confused to give destination name in Log Source Auto-Creation Parameters in Wincollect - InstallShield Wizard.

should it be Event processor IP address or IP of log source name itself?

Thanks

Hi,

the process is different to managed and stand-alone Wincollect Agents...

without a preconfigured destination in the QRadar Console, the agent will register but an associated logsource will not be created. In this case you can create it manually for this logsource after that...

To avoid this you in a manged Wincollect deployment you can configure destinations under admin -> wincollect -> destinations (pls see wincollect user guide). The name you use here, is the name you use during Agent installation..

For stand-alone wincollect agent deployment, therefore you do not need to create a destination in QRadar.

Regards,

Ralph

Thank you.

Can we give IP address of the destination name.

Thanks

Many agents configured with the same log source host IP address in destination name field, but it is reporting fine.

Is this correct? can configure using the same host ip address?

Hi,

Destination Name identifies where WinCollect events are sent. It could be any QRadar appliance name which can receive Events (such as, QRadar AIO, Event Processor & Event Collector) and in Hostname / IP field, specify the IP address or hostname (resolvable) of the receiving QRadar appliance.

Hope it answers your query.