Rewrite handling of auth.log rotation. We'll now watch the parent directory and wait for the create event for auth.log.