All Apps and Add-ons

WindowsUpdate.log - Cannot access the file because it is being used by another process?


The WindowsUpdate.log file is being generated using the Splunk Add-on for Microsoft Windows app.

## Enable below powershell and monitor stanzas to get WindowsUpdate.log for Windows 10 and Server 2016
## Below stanza will automatically generate WindowsUpdate.log daily
script = ."$SplunkHome\etc\apps\Splunk_TA_windows\bin\powershell\generate_windows_update_logs.ps1"
schedule = 0 */24 * * *

## Below stanza will monitor the generated WindowsUpdate.log in Windows 10 and Server 2016
sourcetype = WindowsUpdateLog

However, the Splunkd.log shows it's always 'in use'? As such, I obviously don't get any data into Splunk.

06-18-2019 20:43:09.817 +1000 WARN TailReader - Access error while handling path: failed to open for checksum: 'C:\Program Files\SplunkUniversalForwarder\var\log\Splunk_TA_windows\WindowsUpdate.log' (The process cannot access the file because it is being used by another process.)

This is happening on every server I've deployed the Splunk Add-on for Microsoft Windows app.
Is there something I've missed?

0 Karma

Path Finder

@blake1987 Looks like your WindowsUpdate.log might be open in some editor (in my case it was Notepad++) or something which is giving you this error. Please check if this is the case. And close everywhere where this file is currently open. The error should be resolved. Let me know if this solves this issue.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...