Erwyn van der Meer

Today I experienced some strange unexpected log file roll-overs when logging messages using the EntLib extension RollingFileSink. That's an extension I blogged about a month ago. 

I had set a age threshold of 1 day, but instead of rolling over once a day, the RollingFileSink started a new log file for each log entry. Rechecking the configuration multiple times I found nothing wrong with the configuration. Clearing the entire log directory did not help either. The RollingFileSink created a fresh log file, but that file still wasn't reused. Strangely enough another log file with identical settings (apart from the filename) was reused and did not roll over.

So I fired up the debugger and was surprised to see that the RollingFileSink considered the fresh file to be older than 1 day. Digging a little deeper revealed that the file was 40 days old! Then I remembered reading about file system tunneling in Raymond Chen's blog. When the file is deleted, the file system remembers the creation datetime. When the file reappears within a short interval, instead of getting the current datetime as its creation date, it gets the old value. Yikes, but Raymond explains why file system tunneling exists. More details can be found in this KB article. The default tunneling cache time is 15 seconds.

The moral of this story. Wait at least 15 seconds after deleting a file before creating a new file with the same name if you want the new file to have the correct creation date.