Another update for all.
Well Uri from checkpoint has helped look into this for a while now and this is what he found.
From the command line interface doc found here:
http://www.checkpoint.com/support/te.../docs_r55.html on page 62 it states:
The rename operation fails on Windows if the active log that is being
renamed, is open at the same time that the rename operation is taking
place; however; the Logswitch will succeed and the file will be given
the default name $FWDIR/log/current_time_stamp.log.
The new Log File that is created is given the default name
$FWDIR/log/fw.log. Old Log Files are located in the same directory. He went on to say that this open state of the file occurs if you have smart tracker open at the time of the logswitch.
Unfortunately in my case with nothing else open I still have the same issue when performing a logswitch. I am suspicious though that this may be caused by symantec rimporter running on this box.
Feel free to add your thoughts.