Does splunk forwarder lock files when reading them?

[pacrip]

I have a script that generates log files which are stored in an area spidered by a splunk forwarder. Whilst running my script i have come across an error which i have traced back to splunk forwarding the data generated at the beginning of the script whilst i am trying to save data to that log file. If I disable splunk forwarder the script runs fine and on all the other machines i have tested it on it is fine as well. am i just really unlucky with the write time of my data and the read time of splunk or does it sound like there is there something deeper here?

(PS also if i put a line in the script that makes it wait half a second before executing the line that fails, that makes it run fine as well.)

[barakreeves]

No, forwarders do not lock files. Please see this Answers: http://answers.splunk.com/answers/31301/does-forwarders-put-a-lock-on-a-log-file-while-forwarding

Curious: does you script try to put a lock on a file? if the file is open by Splunk, it may be the reason your script is failing. Is this a bash, perl, or python script?

[barakreeves]

Please keep us updated.

[pacrip]

Nope, the script is written in powershell and uses a logging module (http://gallery.technet.microsoft.com/scriptcenter/Write-timestamped-output-4ff1565f) to push lines to the file. I used a file handle reader in my error handling and the only process that had access to the file having issues was splunk forwarder which had it open with full (RWD) access. Im taking a look at the logging module to see if the way it saves could be the culprit