https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287593#M54930 <P>Has anyone run into this before? I'm unable to rotate logs due to files being opened by the forwarder. The files have not changed in several days. No new events, nothing. Shouldn't Splunk sleep or let go of the file?</P> Fri, 29 Jul 2016 20:02:09 GMT mcrawford44 2016-07-29T20:02:09Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287593#M54930 <P>Has anyone run into this before? I'm unable to rotate logs due to files being opened by the forwarder. The files have not changed in several days. No new events, nothing. Shouldn't Splunk sleep or let go of the file?</P> Fri, 29 Jul 2016 20:02:09 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287593#M54930 mcrawford44 2016-07-29T20:02:09Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287594#M54931 <P>Have you tried the special Windows-only <CODE>[MonitorNoHandle://&lt;path&gt;]</CODE> in inputs.conf?</P> Fri, 29 Jul 2016 23:08:58 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287594#M54931 martin_mueller 2016-07-29T23:08:58Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287595#M54932 <P>Similar case at <A href="https://answers.splunk.com/answers/98470/on-windows-i-sometimes-get-an-error-during-log-rotation-if-splunk-is-monitoring-that-file-whats-that-about.html">On windows, I sometimes get an error during log rotation if splunk is monitoring that file; what's that about?</A></P> Sat, 30 Jul 2016 01:15:45 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287595#M54932 ddrillic 2016-07-30T01:15:45Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287596#M54933 <P>Won't this allow deletion of a file that is not completely indexed yet?</P> Sat, 30 Jul 2016 23:01:27 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287596#M54933 mcrawford44 2016-07-30T23:01:27Z https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287597#M54934 <P>Maybe... though if you intend to delete the file very soon after it's been written and you have delayed forwarding, you may already be deleting it before the forwarder even starts to get a handle on the file.</P> <P>As an alternative, you can see what happens if you set <CODE>ignoreOlderThan=3d</CODE> or something similar in inputs.conf - the forwarder might let go of the file entirely by then.</P> Sat, 30 Jul 2016 23:55:29 GMT https://community.splunk.com/t5/Getting-Data-In/Windows-Forwarder-Unable-to-rotate-delete-log-file-Handle-open/m-p/287597#M54934 martin_mueller 2016-07-30T23:55:29Z