I have a universal forwarder set up to monitor an apache access log, on a Windows machine. Every few days I get the following message in splunkd.log:
06-30-2011 15:00:39.281 -0700 WARN FileInputTracker - Error reading CRC: The process cannot access the file because another process has locked a portion of the file.
06-30-2011 15:00:39.312 -0700 ERROR TailingProcessor - Ignoring path due to: Could not checksum file='D:\Sundaysky\medusa\logs\media.access.log'.
After which the universal forwarder stops monitoring the file. I know of nothing that locks the log file (as far as I know apache doesn't do this). Moreover, the forwarder doesn't recover from this error - I have to detect this myself and restart the forwarder for it to read the file again.
Any help on this would be greatly appreciated.
