WinCollect Agent Installation, Configuration and Troubleshooting
WinCollect Installation Steps:
1. Always install wincollect agent with Admin privileges
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
![]()
NOTE: Always install wincollect agent with Admin privileges
Always stop service then start
Always stop service before uninstalling wincollect agent
Always delete previous wincollect agent folder in hard drive in case of re-installation
WinCollect Installation Steps:
1. Always install wincollect agent with Admin privileges
2. Click Next
3. Accept the agreement and Click Next
4. Let the user name and organization as it is and Click Next
5. Select the Installation path if you have space in C: drive then leave it as it is other wise change it
Note: Wincollect can cache 600MB (as per setting) logs in default path
6. Put Host Identifier as IP or Hostname then Authentication token then SIEM Server or log collector ip in "Configuration Console (host and port):" and leave the "Syslog Status Server ..." section blank and click Next.
Note:Authentication Token can be taken from SIEM server Web Console "Admin" tab then "User Management" Section and "Authorized services"
7. Click "Enable Automatic Log Source Creation" and put log source name which will appear in SIEM and log source identifier as IP or Hostname which was selected in previous section Host Identifier.
8. Click Next without any changes
9. Click Install
10. Click Finish
WinCollect DSM Configuration Steps
To collect Multiple logs from one server like OS logs and any .txt or .log file of any application on that server. Follow below steps for DSM Configuration
1. Add a DSM to Collect OS Logs and select "security", "system", and "application" or as per requirement.
2. Add a DSM to Collect .txt or .log file logs from same server
