topic Re: When i check logfile and found process cannot access the file because it is being.Is there any solution for this? in Getting Data In

When i check logfile and found process cannot access the file because it is being.Is there any solution for this?

ravivasant — Mon, 17 May 2021 11:42:07 GMT

WARN FilesystemChangeWatcher - error getting attributes of path "C:\pagefile.sys": The process cannot access the file because it is being used by another process.

Re: When i check logfile and found process cannot access the file because it is being.Is there any solution for this?

s2_splunk — Mon, 17 May 2021 18:11:45 GMT

What do you expect to do with pagefile.sys in Splunk? That's the OS swap file, probably locked exclusively and hence not accessible by any other process. Plus, it is a binary file and thus not really suitable for ingestion into Splunk.

Re: When i check logfile and found process cannot access the file because it is being.Is there any solution for this?

Richfez — Thu, 23 Jul 2026 18:41:52 GMT

I stumbled across this while trying to find a solution to some UFs that have gone haywire and decided to try to monitor a bunch of files exactly like pagefile.sys, which of course is silly and doesn't work.

btool says nothing's *told* it to try to monitor those.

I'm going to have them try to restart one of the affected UFs; something's going on and I'll update here when I find out what in case others stumble across this problem.

Re: When i check logfile and found process cannot access the file because it is being.Is there any solution for this?

PickleRick — Thu, 23 Jul 2026 19:30:26 GMT

Notoce that this is not a monitor input. This is from a fschange input. While - if we are to believe the conf spec file - this input type has been deprecated since Splunk 5 (sic!) modern Splunk still comes with at least one fschange input on $SPLUNK_HOME defined by default.

Have you checked your config for any other fschange inputs?