Filebeat lock monitored files?

Elastic Stack Beats
1

Hello,

Can filebeat lock some monitored files for some reasons (Windows Server 2008 R2)?

Regards,
Ovidiu

2

Filebeat keeps the files it is reading open. That is probably what you mean by locked. If that is an issue, see force_close_files config: https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_force_close_files But please read the docs as this can have side affects.

3

Hello,

Thank you for your answer. I think I fix this issue.
The problem was something like that:

  • Filebeat keeps the files in reading mode;
  • Log4Net try to delete a file, but fails;
  • Because it fails, it was not able to create new logs.

It was my mistake :slight_smile:

Have a nice day!
Ovidiu

4

Glad you found a solution.

5

Hi @djvidov could you please tell me how did you fix the issue? I face similar issue in Windows 2012 R8 server. I use log4j for writing logs. did you change anything in log4Net settings or Filebeat?

Thanks in advance!

6

Hello @Sujoy_Acharya,
Sorry for that late answer.
in extended class of RollingFileAppender I've add an try catch in order to avoid crash of log4net like in code shown bellow:

public class DateRollingFileAppender : RollingFileAppender {
    //your code here

    public override void ActivateOptions() {
        //your code here
                if(your delete condition)
                    try
                    {
                        System.IO.File.Delete(files[i]);
                    }
                    catch (Exception ex)
                    {
                          //manage it
                    }
    }
}

I hope this will help you.

Regards,
Ovidiu