Deployment Architecture

does forwarders put a lock on a log file while forwarding?

firasarabo
Path Finder

Hi,
I need to know how splunk forwarders works. does it put a lock on the log file while reading it and while forwarding data to the indexers? I guess not but wanted to make sure.

Tags (1)
0 Karma

ea7777777
New Member

Hi, an old topic.. but I have exactly that poblem.

 

Here my Inputs.conf

 

 

[monitor://D:\daten\Splunk\Abgleich1]
index = rbg_ff1_line_prodel_EPL1
sourcetype = rbg_ff1_line_prodel_EPL1_adjust_1
crcSalt = <SOURCE>
followTail = 1 

 

 

The actual process:

  • An PLC creates and fills up an text file
  • PLC writes very fast step by step 8 lines in the text file. Each line is an component. The writing process stops after each line and starts again with the next one.
  • An universal forwarder grabs that text file.

Now my problem:

  • The PLC cannot write to the text file every 20-100 write cycles. Error code is "text file allready opened by another process"
  • The reason for this is, that the universal forwarder is currently reading the file
  • The proof of this is, as soon as I deactivate the UF, the PLC writes all data without any problems

 

The UF does not block as long as it is only monitoring the file. But when it starts reading the file, it bocks the PLC to write on it.

 

What options do I have to prevent this?

0 Karma

Drainy
Champion

No it doesn't.
It will forward the contents the first time it is run and will then monitor it for any further changes, access to the log file by other services is allowed and completely un-impeded during this 🙂

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...