Filebeat locking application logs

Fillebeat in Windows. I have read topic Filebeat locking files - Elastic Stack / Beats - Discuss the Elastic Stack

Hi Experts,

Our application (whose logs are harvested by filebeat) repeatedly throws permission denied error.

The application doesn't request exclusive access to its logs.

We tried updating a logfile manually via wordpad while filebeat was running but we weren't able to do so. (see pic below)

Screenshot 2023-02-07 at 19.28.14

However, we were able to update the same file after stopping filebeat.

From handle.exe logs we can see that filebeat opens the logs in RWD mode

filebeat.exe pid: 3368 test\m33adm
   38: File  (RW-)   
  338: File  (RWD)   D:\usr\sap\M33\D00\work\dev_w5
  358: File  (RW-)   C:\Infra\fb7.8.1\filebeat-7.8.1-windows-x86_64\filebeat-7.8.1-windows-x86_64\data\filebeat.lock
  378: File  (RWD)   D:\usr\sap\M33\SUM\abap\tmp\hello.txt
  388: File  (RWD)   D:\usr\sap\M33\SUM\abap\tmp\SAPup_error.xml
  38C: File  (RWD)   D:\usr\sap\M33\D00\work\sapstart.env
  390: File  (RWD)   D:\usr\sap\M33\D00\work\dev_w6
  3A0: File  (RWD)   D:\usr\sap\M33\D00\work\VMCavailable.log
  3A4: File  (RWD)   D:\usr\sap\M33\D00\work\wd.pid
  3A8: File  (RWD)   D:\usr\sap\M33\SUM\abap\log\SAPup_troubleticket.zip
  3C0: File  (RWD)   D:\usr\sap\M33\D00\work\kill.sap.cmd
  410: File  (RWD)   D:\usr\sap\M33\D00\work\dev_w2

Please, could you advise here?

Regards,
Anirbaan

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.