Новомодный журнал, не вращающийся
Едва ли вирусный сканер, но BlockWatch (белый базирующийся список, средство проверки целостности памяти) работает как это, путем опроса рабочего VM's, создание снимков или сохранения состояния, затем проверяющего память, выделенную тому гостю. Это работает над Windows 32 и 64 бита ОС.
When /var/log/upstart/api-access.log is archived the original filesystem link to it is removed, however the inode remains as it's being held by the exec-ed process. The process continues to write to this inode even while there is no reference to it and will continue to do so until the process is restarted.
Unless there a particular reason you are redirecting that output to that file you should avoid doing so. Upstart writes all output to a file in /var/log/upstart named after the upstart script anyway. It also re-opens the file on each write so the file gets recreated if it has been removed by the log rotation.
Edit by JennyD: If you do want to write to a file, set your log rotation script to copy and truncate instead of moving the file. That way, the original file handle will stay available, but the contents will be moved to an archive file.