Overview

WinCollect is a Syslog event forwarder that administrators can use to forward events from Windows logs to QRadar. WinCollect can collect events from systems locally or be configured to remotely poll other Windows systems for events.

In WinCollect 7.3.0, you can add a secondary destination to receive events from Stand-alone WinCollect agents. In the event of a disaster, when your primary site is not available, to ensure no data loss, you can redirect incoming data to an active site, in this case, a secondary destination.

Configuring a Secondary Destination for Stand-alone WinCollect Agents

Within the WinCollect Configuration Console -> Destinations, you can select the desired destination name, and you will see a new field called "Secondary Hostname / IP" where you can specify the destination you would like to use, and you will also see a "Failover timeout (seconds)" field that is set to a default of 30 minutes.

References

Visit WinCollect 101 for more information on Getting Started with WinCollect and see the WinCollect Release Notes for a list of resolved issues within this release.