Hi forum,

We are planning to update our client's QRadar SIEM to 750UP5. And we have potentially hit the issue of WinCollect compatibility,

https://www.ibm.com/support/pages/node/6954751#APAR

https://www.ibm.com/support/pages/apar/IJ45284

There is a large amount of WinCollect agents with version 7.3.1-22 (7.3.1patch1) in which QRadar 750UP4 or up is not officially compatible with.

My questions are,

1. Although there is a known issue of management and configuration error (IJ45284), can QRadar SIEM 750UP5 with its new WinCollect component still receive logs from WinCollect agents with version 7.3.1-22 (7.3.1patch1)?
2. Are there any other potential issues regarding the situation if our client insists not to upgrade WinCollect agent (just yet).

Any knowledge is appreciated! 

Thank you!

Best regards,

Philip

------------------------------
Philip Ng
------------------------------

1. Speaking from experience, you will still get logs after updating the appliance, yes. Management will be an issue as you pointed out.
2. Management features will not work (ability to configure WinCollect log sources, including new ones, from QRadar); Existing APARs, CVEs.

My recommendation is to update relatively quickly, but if you acknowledge the above, it's not critical.

I would add to this that you should ensure that you are adding any new agents before you upgrade. If you delay upgrading WinCollect, you will NOT be able to add any new agents as the communication issue will prevent new agents from adding in the QRadar user interface. 

As mentioned:
1. Events are still sent to QRadar.
2. You cannot edit your remote the log sources.
3. You cannot add new agents in managed mode as they will not be able to register with the Console appliance. 

If you need to make a change to an existing agent, you could potentially flip it to stand-alone in a pinch. You can edit the install_config.txt file and removing the value in the ConfigurationServer= field. This would allow you to install the Configuration Console for WinCollect 7 to edit any critical log sources if an issue pops up. You'll want to make sure you also make the same change on the Console side, even if the management is down until you upgrade your WinCollect versions. That way, in the future if you add the ConfigurationServer= value back in, it will get the lastest log source update from the Console after you upgraded. Just make sure you note any agents you need to put back in managed mode later. 

Sections 2 & 3 from this article does discuss how to set WinCollect 7 agents from managed to stand-alone mode, if you need to make an important log source change and how to install the Configuration Console. 

I would check with your customer if they need to add any WinCollect agents before you upgrade, just to ensure those hosts are sending events. As after you upgrade and the communcation issue is present, you won't be able to add any new WinCollect agents.

------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com
------------------------------

Hi Jonathan,

Thank you for the knowledge! Very informative and it will totally help out with my next operation!

Best regards,

Philip

Hi Jared,

Thank you for the concise answer! Exactly what I needed! 

Best regards,
Philip