gzip
removed the file log.txt
while the Java process still had it open. Removing a file in fact means removing a name of that file. (When a file has several names, it's said to have several hard links.) The file data is only deleted when all of the file names have been removed and the file is not open by any process. So after the file disappeared, it was still on the disk; the file was only actually removed when the Java process exited or closed the file.
Note that the Java process is still writing to the now-deleted file. It doesn't matter if you create a new file with the same name: that's a different file.
If a file has no name left, on most unices, you can't re-create a hard link to it, even if the file is still open. There was a proposed patch to introduce a flink
system call to do that on Linux, but it was shot down.
You can still read the contents of the file (conveniently on Linux, and perhaps less conveniently on most unices). The directory /proc/1234/fd
where 1234 is the PID of the Java process contains symbolic links to the files that the process has open. If one of these files is deleted, the symbolic link is dangling but it can still be opened for reading.
This will allow you to extract all the log lines from the process. Run
tail -c +$(($(zcat log.txt.gz | wc -c) + 1)) -f </proc/1234/fd >more-log.txt
until the Java process has died.