The Broker or Server log files were deleted from their configured location (brokerLogFile, srvrLogFile). In a Unix OS architecture a file can be deleted even when it is still in use by a process.
- When users delete a file, they remove a link to the file (to the inode).
- If someone still has that file open, they get to keep the file descriptor they have.
- The file remains on disk, taking up space and can be written to and read from if they have access to it.
The unlink function is defined with this behaviour by POSIX:
When the file's link count becomes 0 and no process has the file open, the space occupied by the file shall be freed and the file shall no longer be accessible. If one or more processes have the file open when the last link is removed, the link shall be removed before unlink() returns, but the removal of the file contents shall be postponed until all references to the file are closed.
The daemon will have the file open, and won't notice that it has been deleted (unless it was monitoring it specifically, which is uncommon). It will keep blithely writing to the existing file descriptor it has: it keeps taking up (more) space on disk, but won't be able to see any of the messages it writes.
If users truncate the file to zero length instead then the space is freed up immediately, and any new messages will be appended at the new end of the file where you can see them.
Eventually, when the daemon terminates or closes the file, the space will be freed up. Nobody new can open the file in the mean time (other than through system-specific reflective interfaces like Linux's /proc/x/fd/...).
It's also guaranteed that, if the link count of the file is 0, when all file descriptors associated with the file are closed, the space occupied by the file shall be freed and the file shall no longer be accessible.
So users don't lose your disk space permanently, but don't gain anything by deleting the file and lose access to new messages.
In the meantime, the AppServer/WebSpeed process will continue to write to that file descriptor, users will not be able to (ls -l) and see that file but the process itself does not know that the file has been deleted. For further clarification, the following Article outlines this behavior when Client-Temp files are deleted. The same applies to any file on the system:
