Lock files on Windows server

[skibum]

Does Splunk lock the log file while we’re reading it? This would be on my Windows server IIS and Exchange.

[Ledio_Ago · Accepted solution]

Tailing uses CreateFile with these flags:

FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE

http://msdn.microsoft.com/en-us/library/aa363858%28VS.85%29.aspx

There is no problem for another process to be writing to the file while Splunk is reading the same file.

[jrodman]

Note that if another program opens the file without the FILE_SHARE_READ flag, then either splunk will not be able to open the file, or the other program will not be able to open it if Splunk already has it open.

[gkanapathy]

No it does not.