Getting Data In

Does splunk forwarder lock files when reading them?

pacrip
Path Finder

I have a script that generates log files which are stored in an area spidered by a splunk forwarder. Whilst running my script i have come across an error which i have traced back to splunk forwarding the data generated at the beginning of the script whilst i am trying to save data to that log file. If I disable splunk forwarder the script runs fine and on all the other machines i have tested it on it is fine as well. am i just really unlucky with the write time of my data and the read time of splunk or does it sound like there is there something deeper here?

(PS also if i put a line in the script that makes it wait half a second before executing the line that fails, that makes it run fine as well.)

0 Karma

barakreeves
Splunk Employee
Splunk Employee

No, forwarders do not lock files. Please see this Answers: http://answers.splunk.com/answers/31301/does-forwarders-put-a-lock-on-a-log-file-while-forwarding

Curious: does you script try to put a lock on a file? if the file is open by Splunk, it may be the reason your script is failing. Is this a bash, perl, or python script?

barakreeves
Splunk Employee
Splunk Employee

Please keep us updated.

0 Karma

pacrip
Path Finder

Nope, the script is written in powershell and uses a logging module (http://gallery.technet.microsoft.com/scriptcenter/Write-timestamped-output-4ff1565f) to push lines to the file. I used a file handle reader in my error handling and the only process that had access to the file having issues was splunk forwarder which had it open with full (RWD) access. Im taking a look at the logging module to see if the way it saves could be the culprit

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...