diff --git a/CHANGELOG.asciidoc b/CHANGELOG.asciidoc
index d18bba3b31..2c61fa1db5 100644
--- a/CHANGELOG.asciidoc
+++ b/CHANGELOG.asciidoc
@@ -34,6 +34,7 @@ endif::[]
 ===== Bug fixes
 * Fixed multiple dropped stats types in a transaction producing invalid JSON: {pull}2589[#2589]
 * Fixed NoClassDefFoundError when using OTel bridge and span.*current() : {pull}2596[#2596]
+* Fallback to standard output when Security Manager prevents writing to log file - {pull}2581[#2581]
 
 [[release-notes-1.x]]
 === Java Agent version 1.x
diff --git a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java
index a253ae1f85..4de4e781ae 100644
--- a/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java
+++ b/apm-agent-core/src/main/java/co/elastic/apm/agent/logging/Log4j2ConfigurationFactory.java
@@ -91,12 +91,20 @@ static String getActualLogFile(@Nullable String agentHome, String logFile) {
                 logFile = logFile.replace(AGENT_HOME_PLACEHOLDER, agentHome);
             }
         }
-        logFile = new File(logFile).getAbsolutePath();
-        final File logDir = new File(logFile).getParentFile();
-        if (!logDir.exists()) {
-            logDir.mkdirs();
+
+        boolean canWrite;
+        try {
+            logFile = new File(logFile).getAbsolutePath();
+            final File logDir = new File(logFile).getParentFile();
+            if (!logDir.exists()) {
+                logDir.mkdirs();
+            }
+            canWrite = logDir.canWrite();
+        } catch (SecurityException e) {
+            canWrite = false;
         }
-        if (!logDir.canWrite()) {
+
+        if(!canWrite){
             System.err.println("[elastic-apm-agent] WARN Log file " + logFile + " is not writable. Falling back to System.out.");
             return SYSTEM_OUT;
         }