# Filebeat lock monitored files?

**URL:** <https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [January 20, 2016, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660 "2016-01-20T13:44:58Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![djvidov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djvidov/32/6135_2.png) [@djvidov](https://discuss.elastic.co/u/djvidov)\
**Post date:** [January 20, 2016, 1:44pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/1 "2016-01-20T13:44:58Z")

</div>

Hello,

Can filebeat lock some monitored files for some reasons (Windows Server 2008 R2)?

Regards,  
Ovidiu

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 21, 2016, 8:19am UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/2 "2016-01-21T08:19:01Z")

</div>

Filebeat keeps the files it is reading open. That is probably what you mean by locked. If that is an issue, see force\_close\_files config: [https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#\_force\_close\_files](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-configuration-details.html#_force_close_files) But please read the docs as this can have side affects.

---

<div class="post-metadata">

**Author:** ![djvidov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djvidov/32/6135_2.png) [@djvidov](https://discuss.elastic.co/u/djvidov)\
**Post date:** [January 21, 2016, 12:59pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/3 "2016-01-21T12:59:47Z")

</div>

Hello,

Thank you for your answer. I think I fix this issue.  
The problem was something like that:

- Filebeat keeps the files in reading mode;
- Log4Net try to delete a file, but fails;
- Because it fails, it was not able to create new logs.

It was my mistake 🙂

Have a nice day!  
Ovidiu

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [January 21, 2016, 1:58pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/4 "2016-01-21T13:58:29Z")

</div>

Glad you found a solution.

---

<div class="post-metadata">

**Author:** ![Sujoy\_Acharya](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sujoy_acharya/32/12050_2.png) [@Sujoy\_Acharya](https://discuss.elastic.co/u/Sujoy_Acharya)\
**Post date:** [September 30, 2016, 6:16pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/5 "2016-09-30T18:16:06Z")

</div>

Hi @djvidov could you please tell me how did you fix the issue? I face similar issue in Windows 2012 R8 server. I use log4j for writing logs. did you change anything in log4Net settings or Filebeat?

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![djvidov](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/djvidov/32/6135_2.png) [@djvidov](https://discuss.elastic.co/u/djvidov)\
**Post date:** [October 26, 2016, 2:18pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/6 "2016-10-26T14:18:53Z")

</div>

Hello @Sujoy_Acharya,  
Sorry for that late answer.  
in extended class of RollingFileAppender I've add an try catch in order to avoid crash of log4net like in code shown bellow:

```
public class DateRollingFileAppender : RollingFileAppender {
    //your code here

    public override void ActivateOptions() {
        //your code here
                if(your delete condition)
                    try
                    {
                        System.IO.File.Delete(files[i]);
                    }
                    catch (Exception ex)
                    {
                          //manage it
                    }
    }
}

```

I hope this will help you.

Regards,  
Ovidiu

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/filebeat-lock-monitored-files/39660/7 "2017-07-05T21:50:25Z")

</div>