I have a cron job which
"mv"s mainlog to some other file name
looks for any files which are older than 4 hours
and processes each of them into a "per day" log file.
The result is that each file holds exactly a day's logs, removing the need to
search around for info.
Yesterday I noticed two saved files (cron runs it every 6 hours, so there
should always be one), the first being "Apr 18 16:09 1996-04-18+12:42:03"
i.e. it was "mv"ed at 12:42, but last written to over three hours later at
16:09, so it looks like some caution is needed when processing files ....