topic Re: Batch not indexing previously locked file in Getting Data In

Batch not indexing previously locked file

joonradley — Tue, 21 Feb 2012 09:06:35 GMT

Hi,

I have a problem where batch input will not index files that was locked when Splunk first tried to index the file.

The splunkd.log shows the following entries:

02-20-2012 21:15:43.145 +0200 WARN TailingProcessor - Will retry file='c:\data\data_20120220211543083.log' in 10000ms due to: The process cannot access the file because it is being used by another process.

02-20-2012 21:15:53.005 +0200 ERROR TailingProcessor - Ignoring path due to: failed to open for checksum: 'c:\data\data_20120220211543083.log' (The process cannot access the file because it is being used by another process.)

The file remains in the directory even after it is no longer locked and no further entries are found in splunkd.log for the file 12 hours after the initial entries.

Other files that are not locked get indexed and deleted.

How can I get Splunk to index the previously locked files?

inputs.conf
[batch://c:\data]
sourcetype=AuditData
move_policy = sinkhole
crcSalt =

System: Windows 2008 R2 64-bit, Splunk 4.2.4

Thx

Joon

Re: Batch not indexing previously locked file

MarioM — Tue, 21 Feb 2012 10:21:20 GMT

did you try moving the file into a subdirectory?

Re: Batch not indexing previously locked file

joonradley — Tue, 21 Feb 2012 12:01:02 GMT

Thx, moving the files got them indexed, but it does not solve the underlying issue. The locked files do not get indexed.

Any ideas on that?

Re: Batch not indexing previously locked file

MarioM — Tue, 21 Feb 2012 12:28:58 GMT

I am not in batch mode locked files can be indexed if they are being used by another process...I know it does when on monitor mode

Re: Batch not indexing previously locked file

NiklasB — Tue, 17 Jul 2012 12:49:41 GMT

Suggest taking a look at this:
http://splunk-base.splunk.com/answers/53046/apache-rotatelogsexe-interfering-with-splunk-indexing