I'm runnig a java server on Debian with this command:

  java -jar myapp.jar [args] >> log.txt

Once I gzipped the log file to send it and then I realized the original file was gone, leaving me with only the .gzip.

Although I created the file manually (and also tried to unzip the original) the app didn't log anymore to that file. So my questions are: where does that log go after that? Is there any way to re-route the output log file without restarting the app (as it is a server, I'd rather not kill the process).


From man gzip:

 -k, --keep        Keep (don't delete) input files during compression or

So gzip -k log.txt should do the trick.

(But generally, a real logging solution, i.e., some syslog daemon, maybe with using log4j, could possibly be preferable.)

  • thank you for your quick answer! and yes, we are planning on implementing log4j sometime in the future but for now we need it running. Any ideas on how to re-route the output in case tragedy strikes again? :-P – rMaero Jan 20 '12 at 17:38
  • I have no idea, sorry. Would be interesting to know, though. – sr_ Jan 20 '12 at 18:46

gzip removed the file log.txt while the Java process still had it open. Removing a file in fact means removing a name of that file. (When a file has several names, it's said to have several hard links.) The file data is only deleted when all of the file names have been removed and the file is not open by any process. So after the file disappeared, it was still on the disk; the file was only actually removed when the Java process exited or closed the file.

Note that the Java process is still writing to the now-deleted file. It doesn't matter if you create a new file with the same name: that's a different file.

If a file has no name left, on most unices, you can't re-create a hard link to it, even if the file is still open. There was a proposed patch to introduce a flink system call to do that on Linux, but it was shot down.

You can still read the contents of the file (conveniently on Linux, and perhaps less conveniently on most unices). The directory /proc/1234/fd where 1234 is the PID of the Java process contains symbolic links to the files that the process has open. If one of these files is deleted, the symbolic link is dangling but it can still be opened for reading.

This will allow you to extract all the log lines from the process. Run

tail -c +$(($(zcat log.txt.gz | wc -c) + 1)) -f </proc/1234/fd >more-log.txt

until the Java process has died.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.