Log statements are not cleared when you restart SASServer8_1, so differences occur between the logconfig from before and after the log4j2 introduction.
The SASIRMServer.log file captures all of the historical activities, when it should contain only the activities since the most recent server restart.
You can locate the log file on the middle-tier machine at <SASConfig>/<Lev#>/Web/Logs/SASServer8_1/SASIRMServer.log.
This issue occurs because the immediateFlush parameter is missing in the SASIRM(Server)-log4j2.xml.
Set the immediateFlush="true" parameter in SAS_FILE section of the SASIRMServer-log4j2.xml file. Then, restart SASServer8_1.
You can find the SASIRMServer-log4j2.xml on the middle-tier machine at <SASConfig>/<Lev#>/Web/Common/LogConfig/SASIRMServer-log4j2.xml.
Resolution
A code fix for the issue was included in SAS® Infrastructure for Risk Management 3.7 Hot Fix M2Q003. Apply the latest SAS Infrastructure for Risk Management 3.7 Hot Fix to obtain the code fix.
See SAS Infrastructure for Risk Management 3.7 | Hot Fix Downloads for additional information.