Changing the event port for IBM Security Host Protection for Windows may cause the agent to go Offline
How do you change the event port for IBM Security Host Protector for Windows on the sensor?
After changing the event port in Agent Manager properties, IBM Security Host Protection for Windows agent will go offline. This article provides information on how to change the event port to match the new port settings on the Agent Manager.
Before performing the procedure below, please make sure that you have updated the Group Settings policy that the sensor uses (this is used by this agent for how it will communicate with SiteProtector). This policy must contain the new port number for the Agent Manager, otherwise the changes made manually on your agent by performing this procedure will be overwritten. Thus, making the agent go offline again. This setting is found in the Agent Manager List tab. The default port is 3995. Be sure to change this to your desired port.
To change the event port on the IBM Security Host Protection for Windows agent, please follow the instructions below:
- On the sensor's server, go to \Program Files\IBM\Server Protection and open the GroupSettings.xml file with a text editor.
Note: If running on x64 platform, it will be located in \Program Files (x86)\IBM\Server Protection.
- Find the line that starts with controller-info xmlns='http://www.iss.net/cml/GroupSettings'. On this line, modify the port='3995' section with the updated event port as was modified on the Agent Manager earlier.
- Restart the Blackice service and the agent should return to an active state in SiteProtector.