# File open mode

**URL:** <https://discuss.elastic.co/t/file-open-mode/54840>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 6, 2016, 2:39pm UTC](https://discuss.elastic.co/t/file-open-mode/54840 "2016-07-06T14:39:20Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\
**Post date:** [July 6, 2016, 2:39pm UTC](https://discuss.elastic.co/t/file-open-mode/54840/1 "2016-07-06T14:39:20Z")

</div>

Hello,

While troubleshooting an issue on our Windows servers, we saw that Filebeat is opening files in read/write mode.

Should it be read only mode?  
There's no reason to be other than readonly.

```
O:\Outils\SysinternalsSuite>tasklist | findstr fileb
filebeat.exe 6024 Services 0 75,816 K

O:\Outils\SysinternalsSuite>handle -a -u -p 6024 | findstr depot_journal
  2D0: File (RWD) D:\depot_journal\mpo-app\mpo-web2-cluster-ms2\det\acces.log
  2EC: File (RWD) D:\depot_journal\mpo-apppr\mpo-batch-cluster-ms1\mpo-com\application.log
  2F0: File (RWD) D:\depot_journal\mpo-app\mpo-web1-cluster-ms2\mpo-audit\acces.log
  318: File (RWD) D:\depot_journal\mpo-apppr\mpo-web1-cluster-ms2\mpo-portail\application.log
  354: File (RWD) D:\depot_journal\mpo-apppr\mpo-web1-cluster-ms2\mpo-audit\acces.log
  3A8: File (RWD) D:\depot_journal\mpo-app\mpo-web1-cluster-ms2\mpo-com\application.log
  3B4: File (RWD) D:\depot_journal\mpo-apppr\mpo-web2-cluster-ms2\mpo-identite\application.log
  3B8: File (RWD) D:\depot_journal\mpo-app\mpo-web2-cluster-ms2\set\application.log
  3C8: File (RWD) D:\depot_journal\mpo-app\mpo-web2-cluster-ms2\mpo-identite\application.log

```

Thanks,  
Bruno

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 6, 2016, 7:36pm UTC](https://discuss.elastic.co/t/file-open-mode/54840/2 "2016-07-06T19:36:17Z")

</div>

I can't seem to find any documentation as to where exactly the RWD data is coming from, but it looks to me like that is actually the `dwShareMode` parameter to [`CreateFile`](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx) and not the `dwDesiredAccess` parameter.

Here's the Filebeat code showing that it requests only read access. [https://github.com/elastic/beats/blob/11499e6c825618601adb801b9623fbfe0962d7fe/filebeat/input/file/file\_windows.go#L93](https://github.com/elastic/beats/blob/11499e6c825618601adb801b9623fbfe0962d7fe/filebeat/input/file/file_windows.go#L93)

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [July 11, 2016, 8:41am UTC](https://discuss.elastic.co/t/file-open-mode/54840/3 "2016-07-11T08:41:33Z")

</div>

@Bruno_Lavoie Any chance to confirm what @andrewkroh found above? I would also hope that this column is the share mode.

---

<div class="post-metadata">

**Author:** ![Bruno\_Lavoie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bruno_lavoie/32/8408_2.png) [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\
**Post date:** [July 11, 2016, 7:05pm UTC](https://discuss.elastic.co/t/file-open-mode/54840/4 "2016-07-11T19:05:43Z")

</div>

Yes, I just confirmed with ops and it's dwShareMode, because it appears that we can delete manually some of these files when not opened in exclusive mode by the logging library and in use by filebeat.  
Thanks and sorry

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2016, 2:39pm UTC](https://discuss.elastic.co/t/file-open-mode/54840/5 "2016-07-27T14:39:21Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.