Sidecar 1.1.0 with winlogbeat file lock issue

Hi group have u seen this error ? file is locked by other process. I get this error on some servers like 10 of 200 that are installed and same config and token.

2021-11-25 16:36:15.4767747 +0100 CET m=+0.072002101 write error: failed to rotate backups: failed to rotate backups: rename C:\Program Files\Graylog\sidecar\logs\winlogbeat C:\Program Files\Graylog\sidecar\logs\winlogbeat.1: The process cannot access the file because it is being used by another process.
Exiting: error initializing publisher: txfile/open: file=‘C:\Program Files\Graylog\sidecar\cache\winlogbeat\spool.dat’: failed to lock file
file/lock: C:\Program Files\Graylog\sidecar\cache\winlogbeat\spool.dat: file lock failed: file can not be locked right now
spool queue: failed to open file at path ‘C:\Program Files\Graylog\sidecar\cache\winlogbeat\spool.dat’

// Anders

Helpful Posting Tips: Tips for Posting Questions that Get Answers [Hold down CTRL and link on link to open tips documents in a separate tab]


Yes I have.

You have another application/process accessing that file so its locked. You would need to find the other application/process that is running which is interfering with that log file.
Unfortunately with the lack of information giving it hard to give you a direct answer.

I can get the same results if I used WordPad to open winlogbeat log file when WinLogBeat is trying to rotate log files.

aha okie yes i will try find whats looks the files then… mayby some AV that reads the files