https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-forwarder-locking-file/m-p/475004#M81567 <P>Hello,</P> <P>We have the issue with the Splunk forwarder, which we would like to understand. We monitor one of the directories for the pattern dev_*. The point is that there is a file there, dev_tp_23480, which is created, then deleted, then again created from the application side.<BR /> The issue is that apparently Splunk sets a lock and the second creation of the file by the application is not possible anymore, we get an error.<BR /> After Splunk forwarder gets switched off, all runs fine again, the dev_tp_23480 can be created. So the issue has definitely something to do with Splunk.</P> <P>We do not need this file actually in Splunk, so I have set the blacklist on dev_tp as a workaround, but I am really curious to understand the root cause as it can have an impact on several landscapes.</P> <P>Also, we took a trace of the file accesses (please see picture / attachment) and we clearly see that the splunkd is accessing/checking this file with really high frequency. <BR /> Actually, from the configuration interval (15 sec) I would expect splunkd checking files only 15 sec.<BR /> Do I understand it wrong?<BR /> And if splunkd checks the files in the realtime, isn't it a bit resource intensive? Can it be parametrized? (frequency)</P> <P>Kind Regards,<BR /> Kamil</P> <P><IMG src="https://community.splunk.com/storage/temp/275057-file-access-trace.png" alt="alt text" /></P> Wed, 30 Sep 2020 02:48:57 GMT damucka 2020-09-30T02:48:57Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-forwarder-locking-file/m-p/475004#M81567 <P>Hello,</P> <P>We have the issue with the Splunk forwarder, which we would like to understand. We monitor one of the directories for the pattern dev_*. The point is that there is a file there, dev_tp_23480, which is created, then deleted, then again created from the application side.<BR /> The issue is that apparently Splunk sets a lock and the second creation of the file by the application is not possible anymore, we get an error.<BR /> After Splunk forwarder gets switched off, all runs fine again, the dev_tp_23480 can be created. So the issue has definitely something to do with Splunk.</P> <P>We do not need this file actually in Splunk, so I have set the blacklist on dev_tp as a workaround, but I am really curious to understand the root cause as it can have an impact on several landscapes.</P> <P>Also, we took a trace of the file accesses (please see picture / attachment) and we clearly see that the splunkd is accessing/checking this file with really high frequency. <BR /> Actually, from the configuration interval (15 sec) I would expect splunkd checking files only 15 sec.<BR /> Do I understand it wrong?<BR /> And if splunkd checks the files in the realtime, isn't it a bit resource intensive? Can it be parametrized? (frequency)</P> <P>Kind Regards,<BR /> Kamil</P> <P><IMG src="https://community.splunk.com/storage/temp/275057-file-access-trace.png" alt="alt text" /></P> Wed, 30 Sep 2020 02:48:57 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-forwarder-locking-file/m-p/475004#M81567 damucka 2020-09-30T02:48:57Z https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-forwarder-locking-file/m-p/475005#M81568 <P>Best thing is not to monitor the file itself. As per my understanding there is no interval control over file monitoring, it is only there for modular and scripted inputs.</P> Tue, 05 Nov 2019 07:18:08 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-Splunk-forwarder-locking-file/m-p/475005#M81568 manjunathmeti 2019-11-05T07:18:08Z