Please help me to create below script in Bigfix

Content Authoring
1
  1. stop wincollect service
  2. Run the following script:
    wincollect-7.3.0-41.x64.exe /s /v"/qn INSTALLDIR=“C:\Program Files\IBM\WinCollect” HEARTBEAT_INTERVAL=6000 LOG_SOURCE_AUTO_CREATION_ENABLED=True LOG_SOURCE_AUTO_CREATION_PARAMETERS="“Component1.AgentDevice=DeviceWindowsLog&Component1.Action=create&Component1.LogSourceName=%COMPUTERNAME%&Component1.LogSourceIdentifier=%COMPUTERNAME%&Component1.Dest.Name=QRadar&Component1.Dest.Hostname=10.0.70.108&Component1.Dest.Port=514&Component1.Dest.Protocol=TCP&Component1.Log.Security=true&Component1.Log.System=true&Component1.Log.Application=false&Component1.Log.DNS+Server=false&Component1.Log.File+Replication+Service=false&Component1.Log.Directory+Service=false&Component1.RemoteMachinePollInterval=3000&Component1.EventRateTuningProfile=High+Event+Rate+Server&Component1.MinLogsToProcessPerPass=1250&Component1.MaxLogsToProcessPerPass=1875"”"
  3. Start the wincollect service
2

Possibly the easiest option is do this as PowerShell script where you can then add the safety checks to validate the services stop|start successfully then use the fixlet action to create the script. The PowerShell code you can paste that directly into the ActionScript, using the PowerShell option.

image
image1119×683 14.7 KB

3

You would need to make sure you download the wincollect executable into software distribution then use it in a prefetch to download it to the machine but then you could just do:

//prefetch section or the download command to download it

//---- stop service
waithidden cmd.exe /c net stop “Wincollect”

//----install/upgrade Wincollect

waithidden __Download/wincollect-7.3.0-41.x64.exe /s /v"/qn INSTALLDIR=“C:\Program Files\IBM\WinCollect” HEARTBEAT_INTERVAL=6000 LOG_SOURCE_AUTO_CREATION_ENABLED=True LOG_SOURCE_AUTO_CREATION_PARAMETERS="“Component1.AgentDevice=DeviceWindowsLog&Component1.Action=create&Component1.LogSourceName=%COMPUTERNAME%&Component1.LogSourceIdentifier=%COMPUTERNAME%&Component1.Dest.Name=QRadar&Component1.Dest.Hostname=10.0.70.108&Component1.Dest.Port=514&Component1.Dest.Protocol=TCP&Component1.Log.Security=true&Component1.Log.System=true&Component1.Log.Application=false&Component1.Log.DNS+Server=false&Component1.Log.File+Replication+Service=false&Component1.Log.Directory+Service=false&Component1.RemoteMachinePollInterval=3000&Component1.EventRateTuningProfile=High+Event+Rate+Server&Component1.MinLogsToProcessPerPass=1250&Component1.MaxLogsToProcessPerPass=1875"”"

//----start service
waithidden cmd.exe /c net start “Wincollect”