Resolution: When the Logfile microagent monitors a fast roll over log file under Windows, it will cause the log file to stop rolling over.
Workaround
= = = = = = =
There are parameters available in the “hawkagent.cfg“ file that controls how long log files are to be locked during the Hawk read. These parameters are tunable.
-M LogfileMicroAgent
# How often to scan logfiles, in seconds. The default value is 10 seconds.
-scan_rate 10
# The maximum number of kilobytes to read on each scan. The default value is 16 kilobytes.
-block_size 16
# How often to re-evaluate logfile names, in seconds. The default value is 300 seconds.
-eval_rate 300
Note that this is not going to completely resolve the issue but can aid in reducing the frequency. If these parameters are commented, default values will be used. To get better performance, shorten the scan_rate and increase the block_size.