Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Adding Custom Entries to WinCollect Status Messages

You can add custom information to the WinCollect Agent status messages.

  1. In the wincollect/config directory of the Windows host that you want to identify in LEEF logs, create a file that is called heartbeat_custom.props.
    Note:

    You can create, update, or delete this file while your WinCollect deployment is running. Updates to the file are available in logs on the next heartbeat.

  2. Enter the custom information in the heartbeat_custom.props file in the following format, with one entry on each line:

    keyword=value

    Note:

    • The heartbeat_custom.props must not exceed 10 KB.

    • Custom keyword entries must be alpha-numeric and contain no spaces.

    • Custom entries can't contain reserved keywords, such as src, os, dst, sev, log, msg.

    • Custom values can't contain special characters, such as = | [ ] { } < > / \ ' ".

    • Multiple white spaces in custom values are reduced to a single space.

Related Documentation