IBM Support

Changing the event port for IBM Security Host Protection for Windows may cause the agent to go Offline

Technote (FAQ)


How do you change the event port for IBM Security Host Protector for Windows on the sensor?


After changing the event port in Agent Manager properties, IBM Security Host Protection for Windows agent will go Offline. This article provides information on how to change the event port to match the new port settings on the Agent Manager.


Before performing the procedure below, ensure that you have updated the Group Settings policy that the sensor uses (this is used by this agent to specify how it will communicate with SiteProtector). This policy must contain the new port number for the Agent Manager, otherwise the changes made manually on your agent by performing this procedure will be overwritten and the agent will go Offline again. This setting is found in the Agent Manager List tab. The default port is 3995. Be sure to change this to your desired port.

To change the event port on the IBM Security Host Protection for Windows agent, follow the instructions below:

  1. On the sensor's server, go to \Program Files\IBM\Server Protection and open the GroupSettings.xml file with a text editor.

    Note: If running on a x64 platform, the directory will be \Program Files (x86)\IBM\Server Protection.
  2. Find the line that starts with controller-info xmlns=''. On this line, modify the port='3995' section with the updated event port as was modified on the Agent Manager earlier. Save and close the file when finished.
  3. Restart the Blackice service in Windows Services. The agent should return to an Active state in SiteProtector.

Historical Number


Document information

More support for: IBM Security Host Protection
Proventia Server

Software version: 2.2.2

Operating system(s): Windows

Reference #: 1436539

Modified date: 30 June 2014

Translate this page: