IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  WinCollect Storage

    Posted 06/21/19 10:34 AM
    Hi,
    Do WinCollect store events if the link between WinCollect and Event Collector goes down? If yes, how long?
    Can we configure failover/ load balancing in WinCollect? How?

    ------------------------------
    Sushanta Sena
    ------------------------------


  • 2.  RE: WinCollect Storage

    Posted 06/21/19 11:42 AM
    Yes we will store events to disk if we can't connect to the EC.  How long depends on the amount and size of events that the agent is processing.  By default we store up to 6GB of data.  For failover/load balancing are you referring to if an EC goes down we try to connect to a different EC?

    ------------------------------
    Jamie Wheaton
    Development Manager WinCollect and Security Content
    IBM
    Fredericton,NB
    ------------------------------



  • 3.  RE: WinCollect Storage

    Posted 06/22/19 03:17 AM
    Hi Jamie,
    Thank you for the response.
    Ok, So I can add more disk as needed to store logs in WinCollect.
    yes, I was referring to if one EC goes down where the WinCollect is primarily connected, could we configure failover to connect to another EC that WinCollect sends logs to?

    Thank you,
    Sushanta

    ------------------------------
    Sushanta Sena
    ------------------------------

    Original Message


  • 4.  RE: WinCollect Storage

    Posted 06/24/19 06:46 AM
    As I recall, there are options to install EC in HA mode; that way you would use virtual (cluster) IP (that remains active) to send the events from WinCollect to. Since the EC is different from EP/AiO/Console - as it does not really retain the collected data on its disks more than necessary to forward them further, HA setup might have particular/different path in some steps/prerequisites. If you are not using the 15xx appliances, though, maybe the simpler way could be e.g. using vistualization and standard VM restart on another host (after the original hypervisor host fails) while maintaining the IP?

    ------------------------------
    Dusan VIDOVIC
    ------------------------------

    Original Message


Related Content