in reply to Reading log files that get overwritten
Check and see if the inode number changes
( ls -li or stat() ) when the file is truncated.
If so, you can just make a hard link, and then note when the inode numbers don't match anymore.
This also has the advantage of preserving the old data.
If, on the other hand, they are calling truncate(), you'll need to resort to watching file sizes.
In Section
Seekers of Perl Wisdom