Hi all,
First time posting here hoping any QRadar WinCollect guru out there can point me in right direction to fix this issue.
We are getting following errors on all of our WinCollect agents after upgrading to 7.3.3 Fix Pack 4 (From 7.3.1 Patch 7).
From Backend
Agent: {hostname} - Unable to register instance: Invalid Auth Token (xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx)
From WinCollect Error, Warning in Log
msg=Cannot connect to server -- Error code 10060: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond.
log=SRV.System.WinCollectSvc.Service msg=Register with configuration server failed -- The socket connection to the server failed -- will try again later
We tried following
- New auth Token with New WinCollect on new server
- Token on Server does correspond to auth token on Qradar
- Upgraded all WinCollect to 7.2.9-96 (Was 7.2.8-145)
- Tried autoupdate after 7.2.9-96 sfs upgrade on console.
Thank you in advance. If this is not the right place to ask, please let me know.
#QRadar#Support#SupportMigration