4
responses

Hi,

My app runs on Windows and it writes log to the file a.log.
When I run NXLog to watch this file (to send log to the server), My app gets CFileException::sharingViolation trying to write log to a.log file.
It does not happen always, but when the log is big sometimes it happens and my app can not write log to a.log file.

Searching the internet, I found 'You should open the file with CFile::shareDenyNone' to avoid this problem.
So my questions is :
1. Is NXLog opens the file with ' CFile::shareDenyNone'?
2. How can I avoid this problem?

Here's my nxlog.conf 's input configuration.

<Input watchfile>
Module im_file
File 'C:\\Log\\a.log'
Exec $Message = $raw_event;
Exec if file_name() =~ /.*\\(.*)/ $SourceName = $1;
SavePos TRUE
Recursive TRUE
CloseWhenIdle TRUE
</Input>

Any comment will be appreciated.
Thanks

Harry

AskedNovember 22, 2019 - 7:55am

Answer (1)

I suggest using Process Monitor to find out how the files are opened. This should provide more information about the problem.

Comments (3)

  • phg98's picture

    Thank you for the reply.

    Thanks to your advice, I ran Process Monitor and here's what I found.
    1. on "6:10:35.2719478 PM" nxlog opens the log file (C:\SmartSM\Log\VisionLog.log)
    2. on "6:10:35.2722851 PM", before nxlog close the file, my app (VisFrame.exe) is try to open the file then failed with "SHARING VIOLATION"
    3. on "6:10:35.8585900 PM" nxlog close the file. After that time my app can open the file and can write to the file.

    It looks like nxlog opens the file with 'ShareMode: Read, Write, Delete'.
    My app opens the file with 'ShareMode: None'. So I will try to change this and test again.
    If there is any other advice that I can try, it will be greatly appreciated.

    By the way, I have another question.
    In the Process Monitor, there is too many TCP Send/Receive which I can not understand. (SM4XX-PC is my PC)
    "6:10:45.3905815 PM","nxlog.exe","5824","TCP Send","SM4XX-PC:49320 -> SM4XX-PC:49319","SUCCESS","Length: 1, startime: 316168, endtime: 316168, seqnum: 0, connid: 0"
    "6:10:45.3906463 PM","nxlog.exe","5824","TCP Receive","SM4XX-PC:49319 -> SM4XX-PC:49320","SUCCESS","Length: 1, seqnum: 0, connid: 0"
    Why is nxlog send/receive data from my PC to my PC?
    Could you tell me what these are all about?

    Thank you very much!

    Harry

    * Here's a excerpt from the Process Monitor :
    "6:10:35.2719478 PM","nxlog.exe","5824","CreateFile","C:\SmartSM\Log\VisionLog.log","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
    "6:10:35.2719716 PM","nxlog.exe","5824","QueryInformationVolume","C:\SmartSM\Log\VisionLog.log","BUFFER OVERFLOW","VolumeCreationTime: 7/10/2015 4:53:19 PM, VolumeSerialNumber: 88FA-E00C, SupportsObjects: True, VolumeLabel: SysE"
    "6:10:35.2719786 PM","nxlog.exe","5824","QueryAllInformationFile","C:\SmartSM\Log\VisionLog.log","BUFFER OVERFLOW","CreationTime: 11/25/2019 5:33:44 PM, LastAccessTime: 11/25/2019 5:33:44 PM, LastWriteTime: 11/25/2019 6:10:35 PM, ChangeTime: 11/25/2019 6:10:35 PM, FileAttributes: A, AllocationSize: 110,592, EndOfFile: 108,846, NumberOfLinks: 1, DeletePending: False, Directory: False, IndexNumber: 0x900000000ddbb, EaSize: 0, Access: Generic Read, Position: 83,173, Mode: Synchronous IO Non-Alert, AlignmentRequirement: Word"
    "6:10:35.2720117 PM","nxlog.exe","5824","ReadFile","C:\SmartSM\Log\VisionLog.log","SUCCESS","Offset: 83,173, Length: 25,673, Priority: Normal"

    "6:10:35.2721311 PM","VisFrame.exe","2796","CreateFile","C:\","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
    "6:10:35.2721614 PM","VisFrame.exe","2796","QueryNameInformationFile","C:\","SUCCESS","Name: \"
    "6:10:35.2721731 PM","VisFrame.exe","2796","QueryAttributeInformationVolume","C:\","SUCCESS","FileSystemAttributes: Case Preserved, Case Sensitive, Unicode, ACLs, Compression, Named Streams, EFS, Object IDs, Reparse Points, Sparse Files, Quotas, Transactions, 0x3c00000, MaximumComponentNameLength: 255, FileSystemName: NTFS"
    "6:10:35.2721810 PM","VisFrame.exe","2796","CloseFile","C:\","SUCCESS",""
    "6:10:35.2722851 PM","VisFrame.exe","2796","CreateFile","C:\SmartSM\Log\VisionLog.log","SHARING VIOLATION","Desired Access: Generic Write, Read Attributes, Disposition: OpenIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0"

  • phg98's picture

    Hi,

    I tried to change my app to open the log file with ShareDenyNone,
    but I can not change it because my app is an legacy app and the source code can not be found.
    Is there any other way to solve this problem without changing my app?

    Thanks for the help.

    Harry

  • Misaziv's picture
    (NXLog)

    Hi,

    I tried to change my app to open the log file with ShareDenyNone,
    but I can not change it because my app is an legacy app and the source code can not be found.
    Is there any other way to solve this problem without changing my app?
    

    I don't see a way to fix this without changing the app.

    By the way, I have another question.
    In the Process Monitor, there is too many TCP Send/Receive which I can not understand. (SM4XX-PC is my PC)
    "6:10:45.3905815 PM","nxlog.exe","5824","TCP Send","SM4XX-PC:49320 -> SM4XX-PC:49319","SUCCESS","Length: 1, startime: 316168, endtime: 316168, seqnum: 0, connid: 0"
    "6:10:45.3906463 PM","nxlog.exe","5824","TCP Receive","SM4XX-PC:49319 -> SM4XX-PC:49320","SUCCESS","Length: 1, seqnum: 0, connid: 0"
    Why is nxlog send/receive data from my PC to my PC?
    Could you tell me what these are all about?
    

    Could you paste your NXLog config so we can figure out what this is?

    ~MisaZ