Does logmon probe Lock the File?

Document ID : KB000034612
Last Modified Date : 14/02/2018
Show Technical Document Details

Question:

Does logmon probe Lock the File?

 

Answer:

Logmon probe does a shared lock on monitored file and not an exclusive lock - that means, that monitored file can still be written to while logmon is scanning it.

Logmon reads the file into its log file and then does the matching, That is how system logs can be scanned by logmon probe while being written to system/application events.