Windows – Forward UNIX syslog to Windows Event viewer

I've had success with Sysinternals Process Explorer. With this, you can search to find what process(es) have a file open, and you can use it to close the handle(s) if you want. Of course, it is safer to close the whole process. Exercise caution and judgement.

To find a specific file, use the menu option Find->Find Handle or DLL... Type in part of the path to the file. The list of processes will appear below.

If you prefer command line, Sysinternals suite includes command line tool Handle, that lists open handles.

Examples

• c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "e:\" (finds all files opened from drive e:\"
• c:\Program Files\SysinternalsSuite>handle.exe |findstr /i "file-or-path-in-question"

I've used three different systems for centralizing logs:

1. Syslog/syslog-ng forwarding to one host
2. Zenoss for aggregating and alerting events
3. Splunk for log aggregation and search

For #3, I typically use syslog-ng to forward the messages from each host directly into splunk. It can also parse log files directly, but that can be a bit of a pain.

Splunk is pretty awesome for search and categorizing your logs. I haven't used splunk for log alerting, but I think it's possible.