CB,
I was thinking of a similar but opposite approach. We have some existing processes that will fetch the files, but I want to make sure I understand what I have to work with.
I'm curious: did you keep the default logrotate method on the WA?
If I understand it correctly, it only keeps the last 24hrs of data in 10MB chunks, correct?
I would like to have a little more room for error there and maybe keep a couple days worth in case the process hiccups. I'd also like a logical naming convention, but my initial response from F5 support is this is not easily changed.