Thanks Giuseppe, your information gave me enough of a clue to work out what was happening.
On Linux, I always use systemd to enable the cloudnode to run as a service, following Elar's original instructions:
"
[Unit]
Description=Standard ERP Cloud Node
After=syslog.target
After=network.target
[Service]
Type=simple
User=root
WorkingDirectory=
ExecStart=/hansa-cloudnode
KillMode=process
Restart=always
[Install]
WantedBy=multi-user.target
systemctl daemon-reload
systemctl stop hansa-cloudnode.service
systemctl start hansa-cloudnode.service
"
I discovered that all systemd services write their log messages to /var/log/messages by default, so the cloudnode was writing both to hansa.log and to /var/log/messages. To prevent this, I added:
StandardOutput=null
to the [Service] section, then reloaded the daemon and restarted the service. This should probably be added to the original notes on how to set up the service.