Changing the event port for IBM Security Host Protection for Windows may cause the agent to go Offline
How do you change the event port for IBM Security Host Protector for Windows on the sensor?
After changing the event port in Agent Manager properties, IBM Security Host Protection for Windows agent will go Offline. This article provides information on how to change the event port to match the new port settings on the Agent Manager.
Before performing the procedure below, ensure that you have updated the Group Settings policy that the sensor uses (this is used by this agent to specify how it will communicate with SiteProtector). This policy must contain the new port number for the Agent Manager, otherwise the changes made manually on your agent by performing this procedure will be overwritten and the agent will go Offline again. This setting is found in the Agent Manager List tab. The default port is 3995. Be sure to change this to your desired port.
To change the event port on the IBM Security Host Protection for Windows agent, follow the instructions below:
- On the sensor's server, go to \Program Files\IBM\Server Protection and open the GroupSettings.xml file with a text editor.
Note: If running on a x64 platform, the directory will be \Program Files (x86)\IBM\Server Protection.
- Find the line that starts with
controller-info xmlns='http://www.iss.net/cml/GroupSettings'. On this line, modify the
port='3995'section with the updated event port as was modified on the Agent Manager earlier. Save and close the file when finished.
- Restart the Blackice service in Windows Services. The agent should return to an Active state in SiteProtector.