> I think I figured it out.  If my guess is right, the HTTPD opens the
> error log once and caches the file/stream pointer.  When I rename the
> file the inode is not changed, just the file name in the directory.  So,
> the errors keep getting dumped in the error_log_DATE file and my filter
> has been checking against the new empty error_log file...
>
> Does this sound like a reasonable scenerio to those HTTPD guru's out
> there?  If so, I know how to fix the problem, just have to rewrite the
> script...

That is exactly what will happen if you move a file and don't tell apache
to reopen the log files.

You might also consider that out of habit you opened that log file with an
editor and then again out of habit wrote it back.  I accidentally do that
from time to time.  I do get a filename~ file so that I know when I did
that though. :)

Brian Cluff