close

keyboard_arrow_left

Table of Contents Expand all

play_arrow WinCollect 10 Overview
- play_arrow WinCollect 10 overview
  - What's new in WinCollect 10
  - Performance comparison between WinCollect versions
play_arrow Installing WinCollect 10
- play_arrow Installing WinCollect 10
play_arrow Uninstalling WinCollect 10
- play_arrow Uninstalling WinCollect 10
play_arrow WinCollect 10 Stand-alone Console
- play_arrow WinCollect 10 stand-alone console
  - play_arrow Opening the WinCollect 10 stand-alone console
    - Editing a source
    - Adding a destination
  - play_arrow WinCollect 10 stand-alone configuration
    - play_arrow Agent Core
      - Enabling statistics messages
    - play_arrow Credentials
      - Adding a user account
    - Configuring a local source
    - Configuring a remote source
    - play_arrow Destinations
  - play_arrow Agent settings
  - Service status
  - Log Viewer
  - Top Sources
  - Applying pending changes
  - play_arrow Create a source in the Source wizard
    - Creating a local source
    - Creating a remote source
play_arrow Configuration Scripts
- play_arrow Configuration scripts
  - Configuring WinCollect 10 to collect Microsoft security events
  - play_arrow Agent configuration update script use cases
play_arrow WinCollect Sources
- play_arrow WinCollect Sources
play_arrow Advanced Settings
- play_arrow Advanced settings
play_arrow The WinCollect 10 Statistics File
- The WinCollect 10 statistics file
play_arrow WinCollect Terminology
- WinCollect terminology

list Table of Contents

English

keyboard_arrow_right

Common file-based plugin advanced settings

date_range 28-Jun-22

arrow_backward

arrow_forward

You can use the following advanced settings to fine tune many file-based sources.

Parameter

Default value

Description

Identifier Override

hostname/IP

You can override the device identifier for this source.

Filename pattern

*.*

Only files that match this pattern are considered; this is an OS file filter.

Tuning Profile

Automatic Tuning
Low Event Rate
Medium Event Rate
High Event Rate
Max Event Rate
Manual Tuning

Automatic tuning	Determines how to poll for events automatically and adjusts itself over time
Low event rate	Less than 1 event per minute, poll every 10 minutes, 100 events at a time.
Medium event rate	Less than 10 events per second, poll every 30 seconds, 200 events at a time.
High event rate	Less than 500 events per second, poll every 3 seconds, 2000 events at a time.
Max event rate	More than 500 events per second, poll continuously, 5000 events at a time.
Manual Tuning	Manually set the polling interval, events per pass, and batch size.

Manual Tuning

Polling Interval

The length of time (milliseconds) between polls.

Events per pass

Maximum events to collect at each polling interval.

Events per batch

Number of events to fetch per call to the source.

Filter enabled

Checkbox

Turn the filter on or off.

Predefined Filters

No Description

Filter

An Event filter

File monitor type

Auto
Notification based
Folder scanning

Auto	Uses Notification based on the local system and Folder scanning (new files) on remote devices.
Notification based	Uses the Windows folder monitoring system. Not applicable on remote devices.
Folder Scanning	Scans a folder for new files created after the bookmark timestamp.

Files to Process

New Files
All Files

Which files to accept when the system starts and there is no bookmark.

All Files	Scans a folder for new files created after the bookmark timestamp. If no bookmark exists, all files are processed.
New Files	Scans a folder for new files created after the bookmark timestamp. If no bookmark exists, all files are processed.

File reader type

Text (file opened when reading)
Text (file held open)

The type of file reader that should be used to read the contents of the file.

File reader encoding

UTF8 (no conversion)
ANSI (convert to UTF8)
UTF16 (convert to UTF8

How to deal with files without a BOM.

arrow_backward PREVIOUS EVTX Forwarder advanced settings

NEXT arrow_forward File Forwarder advanced settings

Juniper Secure Analytics WinCollect 10 User Guide

Common file-based plugin advanced settings

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry