Getting Data In

Windows Forwarder - Unable to rotate/delete log file. Handle open by splunkd.exe?

mcrawford44
Communicator

Has anyone run into this before? I'm unable to rotate logs due to files being opened by the forwarder. The files have not changed in several days. No new events, nothing. Shouldn't Splunk sleep or let go of the file?

Tags (3)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Maybe... though if you intend to delete the file very soon after it's been written and you have delayed forwarding, you may already be deleting it before the forwarder even starts to get a handle on the file.

As an alternative, you can see what happens if you set ignoreOlderThan=3d or something similar in inputs.conf - the forwarder might let go of the file entirely by then.

0 Karma

ddrillic
Ultra Champion
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Have you tried the special Windows-only [MonitorNoHandle://<path>] in inputs.conf?

0 Karma

mcrawford44
Communicator

Won't this allow deletion of a file that is not completely indexed yet?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>