I've written a simple program, datelog, to split common logs based on the logged date, as opposed to current system time when the log line is seen by the program. This may or may not be exactly what cronolog or another log splitter does already but it was quicker to write my own than to find out what others do.
Using the year and month in the logged request, the line is then written to a file or pipe which includes the YYYYMM computed from the logged data. Yes this is somewhat specific for the common log format. The first [ is assumed to delimit the date. Beware of IPv6 addresses. :)
For log analysis it is important that each log really only contains the requests for each respective month, and each log should ideally be complete for correct analysis results. It's not enough to determine filename based on current time within the log splitter, because a slow request starting at 23:59:59 will then end up in the log file for the wrong month.
I use this with nginx by way of a named fifo which is checked to exist before nginx is started. Note that there is a tradeoff in the program between error detection and buffered output, where datelog currently prefers buffered output for performance reasons, so please make sure that your setup really works, especially when using shell pipes, in order to not lose any log data.
Source code: http://stuge.se/datelog.c
Please feel free to send me any feedback and of course patches!