Logback does not recreate log file after file has been deleted

Question

I have a logger application that runs on a Tomcat server. I am using logback on spring boot framework. Below is my logback.xml file

<configuration debug="true">
    <appender name="FILE" class="ch.qos.logback.core.rolling.RollingFileAppender">
        <file>/var/log/audit/audit.log</file>
        <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">
            <!-- daily rollover -->
            <fileNamePattern>/var/log/audit/audit_%d{yyyy-MM-dd}.%i.log</fileNamePattern>
            <timeBasedFileNamingAndTriggeringPolicy
                    class="ch.qos.logback.core.rolling.SizeAndTimeBasedFNATP">
                <!-- or whenever the file size reaches 50MB -->
                <maxFileSize>100MB</maxFileSize>
            </timeBasedFileNamingAndTriggeringPolicy>
            <!-- keep 30 days' worth of history -->
            <maxHistory>30</maxHistory>
        </rollingPolicy>
        <append>true</append>
        <encoder>
            <pattern>%msg%n</pattern>
        </encoder>
        <filter class="ch.qos.logback.classic.filter.ThresholdFilter">
            <level>INFO</level>
        </filter>
    </appender>

    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%msg%n</pattern>
        </encoder>
    </appender>

    <logger name="com.logger.rest">
        <appender-ref ref="FILE" />
    </logger>

    <root level="INFO">
        <appender-ref ref="STDOUT" />
    </root>
</configuration>

My application logs correctly to the /var/log/audit/audit.log. But at some point I needed to delete the log file. After the delete I notice that no new audit.log file is created when I call the logger application. It is only when I restart the logger application that a new log file is generated.

Is there any way that I can bypass the app restart so that logback automatically creates a new audit.log file (when creating logging information) in case it has been deleted

Answer 1

While your application is running (and Logback within your application has an open handle to the log file) if you delete the log file then Logback won't know that the the file has been deleted (since the Logback process still has an open file handle) but since the file has been deleted Logback cannot actually write anything to disk and this situation remains until Logback is re-initialised (and your FileAppender recreates the file). Typically, this will be done on application startup.

There's an open issue against Logback requesting a change in Logback's behaviour in this situation.

It is somewhat unusual to delete a file which an application's logging sub system (i.e Logback) is configured to write to while that application is active. Perhaps the issue you are trying to address by deleting the file could be addressed in some other way? If not i.e. if you must be able to delete an in-flight log file and expect Logback to create a new file then I think your options are:

• Vote for issue and hope it is resolved soon
• Contribute a PR with a fix for that issue
• Fork Logback and create your own patched version

Answer 2

The accepted answer above is perfectly correct - if you anyways have to "delete" a logfile for some reason another option would be recreating it yourself or just "truncating" it instead of deleting:

$truncate -s0 /var/log/audit/audit.log

# or if your shell does not support `truncate` (like mine on mac) try redirecting no content to your logfile:
$ :> /var/log/audit/audit.log

At least that was perfectly ok in my situation and logback just continued logging...