All Apps and Add-ons

WindowsUpdate.log - Cannot access the file because it is being used by another process?


The WindowsUpdate.log file is being generated using the Splunk Add-on for Microsoft Windows app.

## Enable below powershell and monitor stanzas to get WindowsUpdate.log for Windows 10 and Server 2016
## Below stanza will automatically generate WindowsUpdate.log daily
script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
schedule = 0 */24 * * *

## Below stanza will monitor the generated WindowsUpdate.log in Windows 10 and Server 2016
sourcetype = WindowsUpdateLog

However, the Splunkd.log shows it's always 'in use'? As such, I obviously don't get any data into Splunk.

06-18-2019 20:43:09.817 +1000 WARN TailReader - Access error while handling path: failed to open for checksum: 'C:\Program Files\SplunkUniversalForwarder\var\log\Splunk_TA_windows\WindowsUpdate.log' (The process cannot access the file because it is being used by another process.)

This is happening on every server I've deployed the Splunk Add-on for Microsoft Windows app.
Is there something I've missed?

0 Karma

Path Finder

@blake1987 Looks like your WindowsUpdate.log might be open in some editor (in my case it was Notepad++) or something which is giving you this error. Please check if this is the case. And close everywhere where this file is currently open. The error should be resolved. Let me know if this solves this issue.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...