SMTP Logfile locking on Exchange Server by Crowdsec

crowdsec
1

We are using Crowdsec on our Exchange 2016 Servers.
In the acquis.yml we configured:

use_time_machine: true #Process logs as if we were replaying them to get the timestamp from the 
filenames:
  - C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\FrontEnd\ProtocolLog\SmtpReceive\*.LOG
labels:
  type: exchange-smtp

The Exchange Server itself wants to cleanup this Directory to save disk space, by using its “Transport Service”, which is configured:

ReceiveProtocolLogMaxAge           : 10.00:00:00
ReceiveProtocolLogMaxDirectorySize : 1.953 GB (2,097,152,000 bytes)
ReceiveProtocolLogMaxFileSize      : 10 MB (10,485,760 bytes)
ReceiveProtocolLogPath             : C:\Program Files\Microsoft\Exchange Server\V15\TransportRoles\Logs\Hub\ProtocolLog\SmtpReceive

The Exchangeserver cant delete the Logfiles, as they are locked by the process of Crowdsec (over several days). When the “ReceiveProtocolLogMaxDirectorySize” is reached, the Exchangeservers stops writing further logs.
And when no logs are generated, crowdsec cant do his job.

Any suggestions how to solve that?