# Workaround for Network Volume **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [September 15, 2017, 5:56pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717 "2017-09-15T17:56:49Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![alhbs](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@alhbs](https://discuss.elastic.co/u/alhbs)\ **Post date:** [September 15, 2017, 5:56pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/1 "2017-09-15T17:56:50Z")
According to the FAQ ([https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes](https://www.elastic.co/guide/en/beats/filebeat/current/faq.html#filebeat-network-volumes)) , it's recommended not to use network volumes. How can I work around this? I'm considering setting up a VM on an outside host, and rsync logs or something similar. Then using filebeat on there. Any feedback on this issue would be appreciated. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 15, 2017, 6:24pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/2 "2017-09-15T18:24:45Z")
I think more context in necessary in order to offer advice. Can you please share some more info about your setup. Maybe start with what's producing the logs and why can't you run Filebeat locally? What OS? ---
**Author:** ![alhbs](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@alhbs](https://discuss.elastic.co/u/alhbs)\ **Post date:** [September 15, 2017, 7:02pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/3 "2017-09-15T19:02:48Z")
Hey Andrew, thanks for getting back. We're using network drives here in our office for VMs. Windows Host, Ubuntu 16.04 VMs. Windows host is a hyper-v cluster, with iSCSI share. Filebeat 'works', it just reads it once, and doesn't see any changes after the initial push after starting/restarting filebeat. I'm just trying to get the syslog monitored. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 15, 2017, 7:50pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/4 "2017-09-15T19:50:07Z")
So this is your stack? - Ubuntu VMs with Virtual Disks (ext4) - Hyper-V - Windows running NTFS on iSCSI disks Where is Filebeat running? I wouldn't expect any problems reading from ext4 or NTFS even if they are virtual or iSCSI disks. But if I missed something in your architecture, an alternative could be to [forward](http://www.rsyslog.com/doc/v8-stable/tutorials/reliable_forwarding.html) the syslog data to Logstash. We usually recommend this for OSes where Filebeat cannot be run (like AIX b/c Go isn't supported). ---
**Author:** ![alhbs](https://avatars.discourse-cdn.com/v4/letter/a/f14d63/32.png) [@alhbs](https://discuss.elastic.co/u/alhbs)\ **Post date:** [September 15, 2017, 8:17pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/5 "2017-09-15T20:17:47Z")
File beat is running on the Ubuntu VMs. Is it alright to post links to gist for log files? I'd like to show you the output from debugging. ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [September 15, 2017, 8:29pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/6 "2017-09-15T20:29:21Z")
Sure. Please show the config too. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [October 13, 2017, 8:29pm UTC](https://discuss.elastic.co/t/workaround-for-network-volume/100717/7 "2017-10-13T20:29:27Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.