All Apps and Add-ons

WindowsUpdate.log - Cannot access the file because it is being used by another process?


The WindowsUpdate.log file is being generated using the Splunk Add-on for Microsoft Windows app.

## Enable below powershell and monitor stanzas to get WindowsUpdate.log for Windows 10 and Server 2016
## Below stanza will automatically generate WindowsUpdate.log daily
script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
schedule = 0 */24 * * *

## Below stanza will monitor the generated WindowsUpdate.log in Windows 10 and Server 2016
sourcetype = WindowsUpdateLog

However, the Splunkd.log shows it's always 'in use'? As such, I obviously don't get any data into Splunk.

06-18-2019 20:43:09.817 +1000 WARN TailReader - Access error while handling path: failed to open for checksum: 'C:\Program Files\SplunkUniversalForwarder\var\log\Splunk_TA_windows\WindowsUpdate.log' (The process cannot access the file because it is being used by another process.)

This is happening on every server I've deployed the Splunk Add-on for Microsoft Windows app.
Is there something I've missed?

0 Karma

Path Finder

@blake1987 Looks like your WindowsUpdate.log might be open in some editor (in my case it was Notepad++) or something which is giving you this error. Please check if this is the case. And close everywhere where this file is currently open. The error should be resolved. Let me know if this solves this issue.

0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...