Once in a while you could run into problems with your WinCollect agents. IBM has recently issued an update fixing some of these problems.

In order to easen up (and automate) things a bit for me, I made a (simple, tiny) script which should make this upgrade procedure faster by automatically downloading the file and launching the procedure.

WARNING: this script was made for QRadar 7.3.x version only - if you have another one, you'll have to change the link for the .sfs file (and it should still work).


In case you need a code, here it is:



# A verysimple script intended to download and mount the latest SFS file available at the moment and
# start patching your QRadar ***7.3.x*** WinCollect component to a WinCollect # Agent
# (v7.2.8.P2) SFS Bundle
# More info:

cd /tmp


mkdir -p /media/updates

mount -o loop -t squashfs 730_QRadar_wincollectupdate-728.145.P2.sfs /media/updates

cd /media/updates