The broker implements a flow-to-disk strategy as a means of retaining message content when a queue policy is exceeded. In this strategy, message content (whether persistent or transient) is written to the store, then released from memory. Before the message may be consumed, the message content must be retrieved from the store.
If a broker is stopped while there is flow-to-disk content containing persistent messages, then the broker fails to honour the policy when that content is restored. The policy itself is recovered, however, all message content is restored, even if it violates that policy. In cases where the flow-to-disk content is greater than the available memory, the broker may become unresponsive or fail in its recovery owing to memory starvation.