# Filebeat docker running on windows not allowing application to rotate the log! **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [June 15, 2017, 7:12pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616 "2017-06-15T19:12:07Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 15, 2017, 7:12pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/1 "2017-06-15T19:12:07Z")
I am using filebeat image - [docker.elastic.co/beats/filebeat:5.4.1](http://docker.elastic.co/beats/filebeat:5.4.1) to setup filebeat container locally on windows to read logs from an application and send data to logstash. The application which generate logs will rotate it after '1MB' size. - I have set close\_inactive = 2M. So that filebeat release the handle after 2 minutes. - When application stops writing data and all the data is read from the file, file handle is released. This is as expected. My concern is, - While filebeat container is reading the file, application is not able to rotate the log file after 1MB size. If i run filebeat as a service (Not inside docker) it works as expected i.e logs are rotated after 1MB. How can I avoid this ? ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/2 "2017-06-16T16:41:33Z")
Please see this post and try using the sysinternals tool to see who has the file open. [Filebeat locks application logs on Windows](https://discuss.elastic.co/t/filebeat-locks-application-logs-on-windows/56307/2?u=andrewkroh) What docker driver are you using on Windows? Is it the Hyper-V driver? ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/3 "2017-06-16T17:41:03Z")
Hi Andrew, Thank you for replying to my query! File is being held by VBoxHeadless.exe and java process(application which is writing to the file). I am using virtualbox driverfor docker. > docker-machine create --driver virtualbox machine1 Docker version 1.12.5, build 7392c3b ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 5:54pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/4 "2017-06-16T17:54:32Z")
Do you have detail on the share mask used by the two processes (like RWD) in opening the file? ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 6:34pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/5 "2017-06-16T18:34:12Z")
![](https://us1.discourse-cdn.com/elastic/original/3X/3/e/3e04975b504f17ce66768fe70cc4d49b98d6a8f0.png) ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 6:36pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/6 "2017-06-16T18:36:19Z")
Could you please tell me how can i get share mask used by the process ? Did you mean, ![](https://us1.discourse-cdn.com/elastic/original/3X/a/9/a936c10e3c4e84d44b2809d318b43137f817bac6.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 6:38pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/7 "2017-06-16T18:38:06Z")
That does not show the share mask, try the handle.exe tool from sysinternals. See [File open mode](https://discuss.elastic.co/t/file-open-mode/54840?u=andrewkroh) for an example. ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 6:47pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/8 "2017-06-16T18:47:55Z")
May be this helps. ![](https://us1.discourse-cdn.com/elastic/original/3X/d/3/d322bd459b017a960c39669fafcfbe69e49570d9.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 6:54pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/9 "2017-06-16T18:54:22Z")
With that output it's not possible to attribute the handles to a process. Based on your info that it's VBoxHeadless and java you should be able to get the PID with: `tasklist | findstr VBoxHeadless` Then use the PID in this command: `handle -a -u -p | findstr test-application.log` Repeat that for java.exe. Then we can know what [share mask](https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx) both applications are using. ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 6:56pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/10 "2017-06-16T18:56:53Z")
Ok thanks for detailed steps. ![](https://us1.discourse-cdn.com/elastic/original/3X/f/f/fff09156197ada95a25d798419e0ac942d641583.png) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 7:04pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/11 "2017-06-16T19:04:10Z")
Based on that output where VBoxHeadless.exe has the log file open with `RW-`, I'd say that the shared filesystem used by VirtualBox is to blame. It is not opening the file with `FILE_SHARE_DELETE` so other applications cannot delete or rename the file. ---
**Author:** ![Somnath\_Shantveer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/somnath_shantveer/32/10084_2.png) [@Somnath\_Shantveer](https://discuss.elastic.co/u/Somnath_Shantveer)\ **Post date:** [June 16, 2017, 7:09pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/12 "2017-06-16T19:09:11Z")
Makes sense.FYI, I also tried this scenario in Linux box. I didn't see this issue. - Is there something you aware of which i can do to avoid this issue ? - Should I be using different driver for docker on windows ? Thanks! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [June 16, 2017, 8:19pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/13 "2017-06-16T20:19:32Z")
I'm not aware of way to avoid this, but it's also not something I've encountered. Trying the Hyper-V driver would be an interesting test. Also trying Windows native containers would be interesting (note that Elastic doesn't provide a Windows container image). ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 7:12pm UTC](https://discuss.elastic.co/t/filebeat-docker-running-on-windows-not-allowing-application-to-rotate-the-log/89616/14 "2017-07-06T19:12:33Z")
This topic was automatically closed after 21 days. New replies are no longer allowed.