Installing the WinCollect Agent on a Windows Host

Ensure that the following conditions are met:

• You created an authentication token for the WinCollect agent.

  For more information, see Creating an Authentication Token for WinCollect Agents.

• Your system meets the hardware and software requirements.

  For more information, see Hardware and Software Requirements for the WinCollect Host.

• The required ports are available for WinCollect agents to communicate with JSA Event Collectors.

  For more information, see Communication Between WinCollect Agents and JSA.

• To automatically create a log source for a WinCollect agent, you must know the name of the destination that you want to send your Windows log source to.

  During the installation, you can configure JSA to automatically create a log source for the WinCollect agent host. You must configure a forwarding destination host for the log source data. For more information, see Adding a destinationTo assign where WinCollect agents in your deployment forward their events, you can create destinations for your WinCollect deployment.. The WinCollect agent sends the Windows event logs to the configured destination. The destination can be the console or an Event Collector. To configure automatic log source creation, your JSA must be updated to JSA 2014.1.r1.734536 or later.

1. Download the WinCollect agent setup file from https://support.juniper.net/support/downloads/
2. Right-click the WinCollect agent installation file and select Run as administrator.
3. Follow the prompts in the installation wizard.

   • For information about managed installations, see WinCollect Managed setup type installation wizard parameters

   • For information about stand-alone installations, see WinCollect Stand alone setup type installation wizard parameters .

   Table 1: WinCollect Managed Setup Type Installation Wizard Parameters

   Parameter	Description
   Host Identifier	Use a unique identifier for each WinCollect agent that you install. The name that you type in this field is displayed in the WinCollect agent list of the JSA Console. The value in the Host Identifier field must match the value in the Host Name field in the WinCollect Agent configuration on the JSA Console.
   Authentication Token	The authentication token that you created in JSA, for example, af111ff6-4f30-11eb-11fb-1fc117711111.
   Configuration Server (host and port)	The IP address or host name of your JSA Console, for example, 100.10.10.1 or myhost. This parameter is for your JSA Console or Event Collector. To use an Event Collector as your Configuration Server, your JSA must be updated to 2014.1.r2.794843 or later.
   Create Log Source	If this check box is selected, you must provide information about the log source and the target destination.
   Log Source Name	The name can be a maximum of 255 characters.
   Log Source Identifier	Identifies the device that the WinCollect agent polls.
   Target Destination	The WinCollect destination must be configured in JSA before you continue entering information in the installation wizard.
   Event Logs	The Window event logs that you want the log source to collect and send to JSA.
   Machine poll interval (msec)	The polling interval that determines the number of milliseconds between queries to the Windows host. The minimum polling interval is 300 milliseconds. The default is 3000 milliseconds or 3 seconds.
   Event Rate Tuning Profile	Select the tuning profile: Default (Endpoint): 100/150 Typical Server: 500/750 High Event Rate Server: 1250/1875
   Default Status Server Address	Displays the IP address of the Configuration Server, where status messages from the WinCollect agent are sent.
   Syslog Status Server (if different from default)	An alternative destination to send WinCollect status messages to, such as the heartbeat, if required.

   Table 2: WinCollect Stand Alone Setup Type Installation Wizard Parameters

   Parameter	Description
   Create Log Source	If this check box is selected, you must provide information about the log source and the target destination.
   Log Source Name	The name can be a maximum length of 255 characters.
   Log Source Identifier	Required if the Enable Automatic Log Source Creation check box is selected. Identifies the remote device that the WinCollect agent polls.
   Event Logs	The Window event logs that you want the log source to collect and send to JSA.
   Destination Name	Identifies the destination where you are sending syslog data.
   Hostname / IP	The host name or IP address for the destination.
   Port	The port that WinCollect uses when it communicates with the destination.
   Protocol	TCP or UDP
   Machine poll interval (msec)	The polling interval that determines the number of milliseconds between queries to the Windows host. The minimum polling interval is 300 milliseconds. The default is 3000 milliseconds or 3 seconds.
   Event Rate Tuning Profile	Select the tuning profile: Default (Endpoint): 100/150 Typical Server: 500/750 High Event Rate Server: 1250/1875
   Default Status Server Address	The IP address Destination where status messages from the WinCollect agent are sent.
   Syslog Status Server (if different from default)	An alternative destination to send WinCollect status messages to, such as the heartbeat, if required.
   Heartbeat Interval (msecs)	The frequency, in milliseconds, that heart status messages are sent.

   The Command Line (will be saved in config\cmdLine.txt) field displays a command line from the configuration that you completed. You can use this command for silent, or unattended installations. For more information, see Installing a WinCollect Agent from the Command Prompt.