incrontab?

[Christophe-Marie Duquesne]

This is a quick guess: maybe you monitor a file while its inode is
changing. Do you (or a process) move /var/log/mail.log while
monitoriing it? I suggest you have a look to
http://permalink.gmane.org/gmane.comp.sysutils.incron/16, it helped me
to understand better incron...