When the agent starts (or after rows have been added to the Log Monitor table), it evaluates the log file expression, identifying the most recently updated log file for its current length and last access time. Thereafter, the agent periodically stats each log file that matches the log file expression for additions or modifications since the last status check. This allows a single monitor entry to follow log files that change names (with perhaps date or revision information) without a need to manually modify the given entry.
For example you can use the following expression as <logFilename> in the watch logfile directive for CSAlarm log file which is rotated periodically.
watch logfile 10 0x8 C:\log\CSAlarm*.log 'error' 'CS Alarm error' '' 5
In this scenario, CSAlarm log file is rotated periodically and the log file name is changed with a date stamp, i.e.
CSAlarm20090901.log
CSAlarm20090902.log
CSAlarm20090903.log
etc.
Please refer to CA eHealth SystemEDGE User Guide for more details.