close

keyboard_arrow_left

Table of Contents Expand all

play_arrow WinCollect 10 Overview
- play_arrow WinCollect 10 overview
  - What's new in WinCollect 10
  - Performance comparison between WinCollect versions
play_arrow Installing WinCollect 10
- play_arrow Installing WinCollect 10
play_arrow Uninstalling WinCollect 10
- play_arrow Uninstalling WinCollect 10
play_arrow WinCollect 10 Stand-alone Console
- play_arrow WinCollect 10 stand-alone console
  - play_arrow Opening the WinCollect 10 stand-alone console
    - Editing a source
    - Adding a destination
  - play_arrow WinCollect 10 stand-alone configuration
    - play_arrow Agent Core
      - Enabling statistics messages
    - play_arrow Credentials
      - Adding a user account
    - Configuring a local source
    - Configuring a remote source
    - play_arrow Destinations
  - play_arrow Agent settings
  - Service status
  - Log Viewer
  - Top Sources
  - Applying pending changes
  - play_arrow Create a source in the Source wizard
    - Creating a local source
    - Creating a remote source
play_arrow Configuration Scripts
- play_arrow Configuration scripts
  - Configuring WinCollect 10 to collect Microsoft security events
  - play_arrow Agent configuration update script use cases
play_arrow WinCollect Sources
- play_arrow WinCollect Sources
play_arrow Advanced Settings
- play_arrow Advanced settings
play_arrow The WinCollect 10 Statistics File
- The WinCollect 10 statistics file
play_arrow WinCollect Terminology
- WinCollect terminology

list Table of Contents

English

Agent configuration update script use cases

date_range 28-Jun-22

arrow_backward

arrow_forward

You can change the agent configuration without making manual or scripted edits to the AgentConfig.xml file by using update scripts.

When you copy an update script to the WinCollect patch directory, the Agent performs the actions that are described in your script.

Update script actions

Update scripts can include the following actions:

<Addto> - Adds a child to the relevant node. You can include a type and certain defined key value pairs.

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<WinCollectScript version="10.0">
</WinCollectScript>

<Update> - Updates the value of a key.

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<WinCollectScript version="10.0">
</WinCollectScript>

<Delete> - Similar to <Addto>, except you add the name of the object to the object Path.

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<WinCollectScript version="10.0">
</WinCollectScript>

The agent creates a new configuration in the patch folder and validates the new configuration. When the validation is successful, the old agent configuration is backed up. The agent moves the update script, the old AgentConfig.xml file, and the new AgentConfig.xml file into a backup folder (patch_xxxx) and puts the new agent configuration into operation.

Several sample update scripts are installed with WinCollect 10. They are stored in the \IBM\WinCollect\samples directory.

Examples

Note:

These scripts are examples only. All agent configuration service modules are supported so that you can create your own scripts.

Note:

Update script file names must begin with update_. All other file names are ignored.

update_addXPath.xml

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<WinCollectScript version="10.0">
    <AddTo objPath="LocalSources(Name=Local)" >
        <Source Name="Security XPath" >
            <Parameter name="Query">
                <QueryList>
                  <Query Id="1" Path="Security">
                    <Select Path="Security">*[System[(Level=1  or Level=2 or Level=3) and (EventID=1 or EventID=3 or  (EventID >= 5 and EventID <= 100)  or  (EventID >= 200 and EventID <= 500) )]]</Select>
                  </Query>
                </QueryList>
            </Parameter>
        </Source>
    </AddTo>
</WinCollectScript>

update_delSecurity.xml

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<WinCollectScript version="10.0">
    <Delete objPath="LocalSources(Name=Local)/Source(Name=Security)" />
</WinCollectScript>

update_updtConsPort.xml

content_copy zoom_out_map
<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<WinCollectScript version="10.0">
    <Update objPath="SystemSettings" setParam="Console.Port" value="3333" descr="Changing the Config Console's port to 3333" />
</WinCollectScript>

The following use cases are examples of how you can use update scripts to change agent configurations:

arrow_backward PREVIOUS Configuring WinCollect 10 to collect Microsoft security events

NEXT arrow_forward Adding NSA filtering to an existing source

Juniper Secure Analytics WinCollect 10 User Guide

ON THIS PAGE

Agent configuration update script use cases

Update script actions

Examples

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry