Once in a while you could run into problems with your WinCollect agents. IBM has recently issued an update fixing some of these problems.

In order to easen up (and automate) things a bit for me, I made a (simple, tiny) script which should make this upgrade procedure faster by automatically downloading the file and launching the procedure.

WARNING: this script was made for QRadar 7.3.x version only - if you have another one, you'll have to change the link for the .sfs file (and it should still work).


In case you need a code, here it is:



# A verysimple script intended to download and mount the latest SFS file available at the moment and
# start patching your QRadar ***7.3.x*** WinCollect component to a WinCollect # Agent
# (v7.2.8.P2) SFS Bundle
# More info: https://www-01.ibm.com/support/docview.wss?uid=ibm10791609

cd /tmp

wget https://ak-delivery04-mul.dhe.ibm.com/sdfdl/v2/sar/CM/OS/080gy/0/Xa.2/Xb.jusyLTSp44S0wfNmbWJtgp4MCqzdVI-JhzxFd0tXj8n2KwT0Zp-sMyUVaX4/Xc.CM/OS/080gy/0/730_QRadar_wincollectupdate-728.145.P2.sfs/Xd./Xf.LPR.A6vr/Xg.10008915/Xi.habanero/XY.habanero/XZ.SYhhaj0ZtIeeGQfy01KXCTzfZHU/730_QRadar_wincollectupdate-728.145.P2.sfs

mkdir -p /media/updates

mount -o loop -t squashfs 730_QRadar_wincollectupdate-728.145.P2.sfs /media/updates

cd /media/updates