https://community.splunk.com/t5/Monitoring-Splunk/Why-are-there-error-messages-in-Splunkd-quot-ERROR-ExecProcessor/m-p/434889#M3679 <P>The messages below appear in splunkd.log from splunk_app_infrastructure. The splunk_app_infrastructure is running fine. Searching is also fine, only indexing lags so only old data is found. </P> <P>Additionally, when I try to upgrade an app, I get "Oops" and a drawing of a horse and "500 Internal Server Error". <BR /> Here are the messages in splunkd.log - it seems to be an intense app so it prevents indexing (I think, but know not): </P> <PRE><CODE>ERROR ExecProcessor - message from "python D:\Programs\Splunk\etc\apps\splunk_app_infrastructure\bin\em_entity_manager.py" </CODE></PRE> <P>Prepended to all the lines below </P> <PRE><CODE>Traceback (most recent call last): File "D:\Programs\Splunk\Python-2.7\Lib\logging\handlers.py", line 77, in emit self.doRollover() File "D:\Programs\Splunk\Python-2.7\Lib\logging\handlers.py", line 142, in doRollover os.rename(self.baseFilename, dfn) WindowsError: [Error 32] The process cannot access the file because it is being used by another process Logged from file em_model_entity.py, line 77 </CODE></PRE> Wed, 30 Sep 2020 00:18:33 GMT dkolekar_splunk 2020-09-30T00:18:33Z https://community.splunk.com/t5/Monitoring-Splunk/Why-are-there-error-messages-in-Splunkd-quot-ERROR-ExecProcessor/m-p/434889#M3679 <P>The messages below appear in splunkd.log from splunk_app_infrastructure. The splunk_app_infrastructure is running fine. Searching is also fine, only indexing lags so only old data is found. </P> <P>Additionally, when I try to upgrade an app, I get "Oops" and a drawing of a horse and "500 Internal Server Error". <BR /> Here are the messages in splunkd.log - it seems to be an intense app so it prevents indexing (I think, but know not): </P> <PRE><CODE>ERROR ExecProcessor - message from "python D:\Programs\Splunk\etc\apps\splunk_app_infrastructure\bin\em_entity_manager.py" </CODE></PRE> <P>Prepended to all the lines below </P> <PRE><CODE>Traceback (most recent call last): File "D:\Programs\Splunk\Python-2.7\Lib\logging\handlers.py", line 77, in emit self.doRollover() File "D:\Programs\Splunk\Python-2.7\Lib\logging\handlers.py", line 142, in doRollover os.rename(self.baseFilename, dfn) WindowsError: [Error 32] The process cannot access the file because it is being used by another process Logged from file em_model_entity.py, line 77 </CODE></PRE> Wed, 30 Sep 2020 00:18:33 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-are-there-error-messages-in-Splunkd-quot-ERROR-ExecProcessor/m-p/434889#M3679 dkolekar_splunk 2020-09-30T00:18:33Z https://community.splunk.com/t5/Monitoring-Splunk/Why-are-there-error-messages-in-Splunkd-quot-ERROR-ExecProcessor/m-p/434890#M3680 <P>The messages "The process cannot access the file because it is being used by another process" could be caused by straggling process that still has a file open and we've spawned another process that trying to roll the logs going by: "File "D:\Programs\Splunk\Python-2.7\Lib\logging\handlers.py", line 142, in doRollover os.rename(self.baseFilename, dfn)". </P> <P>Try: Stop splunk, check with Task Manager that there are no processes from the splunk directories left (like those python ones) and restart splunk after. <BR /> More on "WindowsError: [Error 32] The process cannot access the file because it is being used by another process" Kindly check <A href="https://github.com/grangier/python-goose/issues/78">https://github.com/grangier/python-goose/issues/78</A></P> Tue, 30 Apr 2019 14:04:36 GMT https://community.splunk.com/t5/Monitoring-Splunk/Why-are-there-error-messages-in-Splunkd-quot-ERROR-ExecProcessor/m-p/434890#M3680 dkolekar_splunk 2019-04-30T14:04:36Z