entry.timestamp looks to refer to the last time it was used-- which of course a logging event would force an update. The SiftingAppender documentation states:

Whenever SiftingAppender sees a logging event marked as FINALIZE_SESSION it will end-of-life the associated nested appender. Upon reaching its end-of-life, a nested appender will linger for a few seconds to process any late coming events (if any) and then will be closed.

With the current implementation any additional logging events would extend that linger window for 10 seconds from the last event. This would seem like a reasonable implementation as forcing a close just because the 10 seconds expired even if we're continuing to receive logging events for that appender would very likely cause us to immediately open the file back up.

Your adminlog isn't being closed due to LOGBACK-940.