How to set up Windows Event Collector for Windows 2000, 2003 or XP

Products

• Security Information Manager

Issue/Introduction

You want to set up the Windows Event Collector (WEC), what are the steps required to do it?

Resolution

• Note these instructions apply to collection from Windows 2000, 2003, XP. There is a different collector for Windows Vista, 2008 or Windows 7.

• Please read the collector guide completely before you proceed and refer to the Collector Guide for more detail about this installation process and the sensor settings.
  
• If you are troubleshooting and existing Windows Event Collector, refer to the general troubleshooting document, article 2007103010074754.

1. Download the agent to the collector machine. The agent is available for download from the web configuration page, see article 2009112316182254.
2. Download the Microsoft Windows Event Collector files to the agent machine. The collector is available for download from fileconnect, see article 2008102808060454.
3. You may need to create a user on the target Windows machine for the collector. (Optional if collecting only from localhost.) The specifications for the user are listed in article 2010060708422654.
4. Modify the hosts file on the SSIM appliance to reflect the IP address and machine name (usually short name) of the collector machine, see article 2009041711222854. (Optional given perfect DNS.)
5. Modify the hosts file on the collector machine to reflect the IP address and machine name (again usually short name) of the SSIM, see article 2009041711222854. (Optional given perfect DNS.)
6. Install the agent on the collector machine by running setup.exe and following the Wizard according to article 2009120209010354.
7. Install the Collector software on the collector machine by running install.bat from the collector install folder according to article 2009120209143354.
8. Type "Y" to LiveUpdate the collector at the end of the installation process. It is always important to LiveUpdate the collectors even (especially) on a fresh install. For more information about LiveUpdate see article 2009030412363954.
9. Create and distribute the Collector and Sensor Configurations. Article 2010030209302754 discusses creating Collector and Sensor configurations. The collector guide has details about what should be set into each field within the sensor.