Question

We have this strange bug report from a customer: “Log file last modification date is older than log entry time stamp in it”.

The difference is in days (~2 days). It is not a constant thing – just one known case so far.

I am not a guru in log4net implementation – only using it as a 3rd party. Given the loggers configuration is provided bellow are there any possibilities that this has happened cause of some wrong configuration or misunderstanding in log4net RollingFileAppender concept?

Only interested in log4net as a possible source of an issue (i.e. I do understand, that there are external ways to make this happen … perhaps some crappy log files management tool, that modified the date by mistake)

<appender name="CustomAppender" type="log4net.Appender.RollingFileAppender">
  <param name="File" value="log.txt" />
  <param name="AppendToFile" value="true" />
  <param name="MaxSizeRollBackups" value="2" />
  <param name="RollingStyle" value="Size" />
  <param name="StaticLogFileName" value="true" />
  <param name="MaximumFileSize" value="100MB" />
  <layout type="log4net.Layout.PatternLayout,log4net">
    <conversionPattern value="%date %-5level %message%newline" />
  </layout>
</appender>
<logger name="CustomLogger" additivity="false">
  <level value="ALL" />
  <appender-ref ref="CustomAppender" />
</logger>

the usage from code is straight forward (simplified):

LogManager.GetLogger("CustomLogger").Info("Message");

log4net version: 1.2.10.0
The application is a windows service. Language – C# 3.0, but I guess this does not matter.

Answer 1

I see this as well from time to time with log4net. The datetime reported is probably just the datetime at which the log file was last opened for writing by log4net.

It may not update the file datetime until the file is closed again.

[Edit: I’ve just lashed up a simple example locally on my machine and don’t see the behaviour you are describing, but I have seen it before – probably on a Windows 2003 server (as opposed to XP that I am using at the moment). See if you can at least eliminate this as a possibility]