When a DHCP server starts or a new weekday begins (when the local time on the computer is 12:00 a.m.), the server writes a header message in the audit log file, indicating that logging has started. Then, depending on whether the audit log file is a new or existing file, the following actions occur:
If the file already existed without modification for more than a day, it is overwritten.
If the file already existed, but was modified within the previous 24 hours, the file is not overwritten. Instead, new logging activity is appended to the end of the existing file.