IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Wincollect Agents Are Not Loading

    Posted 07/07/23 12:55 AM

    Hi,

    I have updated the wincollect agent 7.3.1-28 after that the agents are not showing in the wincollect tab, it is still loading.  And also facing the QRadar console slowness, and disconnections.



    ------------------------------
    Arunkumar R
    ------------------------------


  • 2.  RE: Wincollect Agents Are Not Loading

    Posted 07/07/23 10:11 AM
    Edited by Jonathan Pechta 07/07/23 10:11 AM

    Can you provide information on your QRadar version? As due to a struts change in the core code base for QRadar, WinCollect has specific version requirements based on the QRadar version. If you are on 7.3.1-28, your QRadar version must be 7.5.0 Update Package 4 or later as mentioned in this flash notice: https://www.ibm.com/support/pages/node/6953887.

    Can you provide your QRadar version so we can understand the issue further? 

    There are more details on this issue here: https://www.reddit.com/r/QRadar/comments/10y6je1/flash_notice_after_upgrading_to_750_up4/



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------



  • 3.  RE: Wincollect Agents Are Not Loading

    Posted 07/07/23 10:22 AM

    QRadar version is 7.5.0 UP6

    Thanks



    ------------------------------
    Arunkumar R
    ------------------------------



  • 4.  RE: Wincollect Agents Are Not Loading

    Posted 07/14/23 02:01 PM

    I'm not sure if you are still having this issue, but I think you should try running WinCollectHealthCheck -d from QRadar to see if any issues pop out to you. I think this is likely going to require a case as someone will likely need to confirm the status of the ale_client table in Postgres to confirm if the agents are set to deleted or why the information is not posting in the user interface as expected. 



    ------------------------------
    Jonathan Pechta
    QRadar Support Content Lead
    Support forums: ibm.biz/qradarforums
    jonathan.pechta1@ibm.com
    ------------------------------