We have a spring boot app using spring boot 2.4.4. According to spring boot's documentation that the logging level of loggers can be dynamically changed using actuator endpoints, https://docs.spring.io/spring-boot/docs/current/actuator-api/htmlsingle/#loggers

the pom

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
            <version>2.2.7.RELEASE</version>
        </dependency>

no spring cloud is included in the dependency or as transitive dependency.

my application.properties

management.endpoints.web.exposure.include=loggers
management.endpoint.loggers.enabled=true

I have tried,

management.endpoint.loggers.post.enabled=true

no difference.

GET works for the actuator loggers endpoint, 

curl -ik  -H 'Content-Type: application/json' http://localhost:8080/actuator/loggers/org.springframework
HTTP/2 200
date: Fri, 01 Apr 2022 15:46:34 GMT
content-type: application/vnd.spring-boot.actuator.v3+json
content-disposition: inline;filename=f.txt
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY

{"configured_level":"INFO","effective_level":"INFO"}

But I got 405 when POST to change logging level,

curl -i -X POST -H 'Content-Type: application/json' -d '{"configuredLevel": "debug"}' http://localhost:8080/actuator/loggers/org.springframework
HTTP/2 405
date: Fri, 01 Apr 2022 15:47:01 GMT
content-type: text/html;charset=utf-8
content-length: 449
set-cookie: JSESSIONID=4435480C10E16A53F466C51EC95DFF80; Path=/; Secure; HttpOnly
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
x-frame-options: DENY
allow: GET
content-language: en

<!doctype html><html lang="en"><head><title>HTTP Status 405 – Method Not Allowed</title><style type="text/css">body {font-family:Tahoma,Arial,sans-serif;} h1, h2, h3, b {color:white;background-color:#525D76;} h1 {font-size:22px;} h2 {font-size:16px;} h3 {font-size:14px;} p {font-size:12px;} a {color:black;} .line {height:1px;background-color:#525D76;border:none;}</style></head><body><h1>HTTP Status 405 – Method Not Allowed</h1></body></html>

With spring actuate package logging at debugging level, I got

[dev-ws-supportconsole-container]2022-04-04 19:22:50.939 TRACE [main] org.springframework.boot.actuate.autoconfigure.endpoint.condition.OnAvailableEndpointCondition # logOutcome:86 - Condition OnAvailableEndpointCondition on org.springframework.boot.actuate.autoconfigure.logging.LoggersEndpointAutoConfiguration matched due to @ConditionalOnAvailableEndpoint found property management.endpoint.loggers.enabled with value true; @ConditionalOnAvailableEndpoint marked as exposed by a 'management.endpoints.web.exposure' property

Comment From: wilkinsona

Thanks for the report but Spring Boot 2.4.x has reached the end of its OSS support period. Please try with a supported version. If the problem still occurs and you would like us to spend some time investigating, please spend some time providing a complete yet minimal sample that reproduces the problem with a currently supported version. You can share it with us by pushing it to a separate repository on GitHub or by zipping it up and attaching it to this issue.

Comment From: gigi888

Thank you for the suggestion. Before I start working on that, can I get one thing clear first, if we have an application.yaml in our spring boot app that defines env specific variables and spring profiles, is it still suggested we use application.properties to define actuator management? like,

management.endpoints.web.exposure.include=loggers management.endpoint.loggers.enabled=true

Comment From: wilkinsona

While, IIRC, it is technically possible to use both application.properties and application.yaml in the same app, we do not recommend it. You should use one file or the other, not both.

Comment From: ghost

@gigi888, could you try the following? I tried it with Spring Boot 2.6.6 and it worked for me.

curl --request POST \
  --url http://localhost:8080/actuator/loggers/_org.springframework \
  --header 'Content-Type: application/json' \
  --data '{
    "configuredLevel": "DEBUG"
}'

Comment From: gigi888

Hi, @isank , Thank you for that reply. I actually found out the reason.

we have spring-boot-starter-security and spring-boot-starter-oauth2-client (SB version 2.4.4) to use oauth 2 to protect most endpoints.

Even though I have configured spring security with

http.authorizeRequests(a -> a .antMatchers("/actuator/**").permitAll() ....

before to allow actuator endpoints to go through, it is only good for GET.

I need to add http.csrf().ignoringAntMatchers("/actuator/loggers/**").and() .authorizeRequests(a -> a .antMatchers("/actuator/**").permitAll() ......

to allow POST. Once I added the above line, I can POST to /actuator/loggers/** to change logging level

Comment From: gigi888

But I have another question now. it may be irrelevant to the POST not working, but it is pertinent in the big picture.

As more and more SB applications are deployed to k8s, so is our application here. I have no control of which POD the POST request goes to to dynamically change the logging level, sadly. Any suggestions that SB + k8s have a solution for 1 call to get the management request to take care of all PODs?

Comment From: scottfrederick

I actually found out the reason. Once I added the above line, I can POST to /actuator/loggers/** to change logging level

Glad to hear you found your problem @gigi888.

But I have another question now.

As mentioned in the guidelines for contributing, we prefer to use GitHub issues only for bugs and enhancements. This is a question that is more related to Kubernetes deployment and would be better suited to Stack Overflow.