It does depend on whether a given logfile is actually being closed by the process that is writing to it. Programs that write to logfiles often keep the file descriptors open for their logfiles. The file descriptor refers to the inode on the filesystem, so removing/moving a file within a filesystem will mean the process will continues to write to the renamed file.

If the file is removed the kernel is merely unlinking it from a directory, but because the file descriptor referring to it still exists, the file itself can still be written to.

Typically you get a syslog daemon to close its file-descriptors by
sending a HUP to it, although this is mere convention.

You can look at: http://iain.cx/src/logrotate/ - most Linux flavors come with a logrotate script in place already.

Just a case in point:

Looking at syslog:
# ls -l syslog
-rw-r--r-- 1 root other 5078349 Dec 10 22:54 syslog

What process has it open:
# fuser -u syslog
syslog: 26317o(root)

Move the file:
# mv syslog syslog.20031210

Inode is still associated with the new file and held open by the process:
# fuser -u syslog.20031210
syslog.20031210: 26317o(root)

Syslog will keep writing to syslog.20031210 until a HUP (kill -HUP) is sent to syslog (only works under some flavors of unix), or syslog is restarted.

Cheers,

Keith