Given the following system configuration:

cat /etc/redhat-release
Red Hat Enterprise Linux AS release 3 (Taroon Update 4)

Linux silver13 2.4.21-27.ELsmp #1 SMP Wed Dec 1 21:59:02 EST 2004 i686 i686 i386 GNU/Linux

I have a java server that somehow or another is creating a hard-linked log file (SERVER.silver13.2006120410) to the normal log file (SERVER.log). Nothing has changed in my java server or with my logging code and based on the extensive troubleshooting that's been done I can't explain why its happening. There's no consistency to the behavior. I know that there is only this one java process writing to the file using the lsof command.

lsof SERVER.silver13.2006120410
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
java 4532 silver 5w REG 58,3 463405 1419926 SERVER.silver13.2006120410
[silver@silver13 logs]$ lsof SERVER.log
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
java 4532 silver 5w REG 58,3 464034 1419926 SERVER.log

How would I go about determining how the hard-link system call is being made? I looked at the kernel debuggers and it looks like there are none available for this particular release.

I've tried strace and nothing has showed up. Systemtamp and frysk are not available on this kernel to my knowledge.

Thanks,

Neil