IBM QRadar

Hi guys,

I'm trying to deploy a WinCollect agent using TLS protocol. The installation and log source deployment runs smoothly, however, no events get to the Console. I keep on receiving the Error 10061:

Cannot connect to server -- Error code 10061: A connection can't be established. The destination host denied the connection.

I'm using WinCollect 7.3.0

Regards,

Gabriel Crespo

Hello

From the WinCollect machine, can you connect to the remote server using event viewer? and see if it goes through? and on WinCollect machine check the logs for error messages

T&R

Hi,

there's no remote server. The WinCollect agent is installed on the server that generates the logs. The problem is not reading the log messages, is sending them to the Console.

Regards,

Gabriel Crespo

Hello,

Any errors on C:\Program Files\IBM\WinCollect\logs\. The log file is named WinCollect.log

T&R

Hi,

The error I posted in the first message are from WinCollect.log

Cannot connect to server -- Error code 10061: A connection can't be established. The destination host denied the connection.

Regards,

Gabriel Crespo

hey,

Can you change to Syslog over 514 tcp/udp instead of tls and give it a try and see if your receiving logs? if it works you can narrow it down to an TLS issue

The guide below shows the config of required TLS settings

https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.wincollect.doc/b_wincollect.pdf?origURL=SS42VS_7.3.2/com.ibm.wincollect.doc/b_wincollect.pdf

T&R

Hi,

There is no problem when using TCP/UDP. It's abviously a TLS problem. It looks like Qradar is not allowing any connection on port 6514 although the log source is configured.

Regards,

Gabriel Crespo

Hello,

I saw your response on email but for some reason its not updated here.

Error code 10061 usually is a an indication that the TLS versions are not negotiated properly, can you check on your system if the TLS versions are correctly configured? and also on QRadar

https://www.ibm.com/support/pages/wincollect-how-enabledisable-tls-communication-options-qradar

T&R