Merge pull request #188312 from JeffreyWolford/patch-1

Update data-sources-custom-logs.md

Author: PRMerger-2

articles/azure-monitor/agents/data-sources-custom-logs.md

@@ -23,9 +23,10 @@ The log files to be collected must match the following criteria.
 
     YYYY-MM-DD HH:MM:SS<br>M/D/YYYY HH:MM:SS AM/PM<br>Mon DD, YYYY HH:MM:SS<br />yyMMdd HH:mm:ss<br />ddMMyy HH:mm:ss<br />MMM d hh:mm:ss<br />dd/MMM/yyyy:HH:mm:ss zzz<br />yyyy-MM-ddTHH:mm:ssK
 
-- The log file must not allow circular logging or log rotation, where the file is overwritten with new entries.
+- The log file must not allow circular logging, log rotation where the file is overwritten with new entries, or the file is renamed and the same file name resues for continued loging. 
 - The log file must use ASCII or UTF-8 encoding.  Other formats such as UTF-16 are not supported.
 - For Linux, time zone conversion is not supported for time stamps in the logs.
+- As a best practice, the log file should include the date time that it was created to prevent log rotation overwiting or renaming.
 
 >[!NOTE]
 > If there are duplicate entries in the log file, Azure Monitor will collect them. However, the query results will be inconsistent where the filter results show more events than the result count. It will be important that you validate the log to determine if the application that creates it is causing this behavior and address it if possible before creating the custom log collection definition.