diff --git a/lib/krb5/krb5_openlog.3 b/lib/krb5/krb5_openlog.3
index 87ad29b33..f233d3c29 100644
--- a/lib/krb5/krb5_openlog.3
+++ b/lib/krb5/krb5_openlog.3
@@ -207,6 +207,16 @@ omitted, in this case min is assumed to be 0, and max is assumed to
 be 3.
 If you don't include a dash, both min and max get set to the
 specified value.
+.Pp
+The paths specified are subject to token expansion.
+For the purposes of logging, the most interesting token
+expansion is
+.ar %{strftime:<string>}
+which calls
+.Xr strftime 3
+on
+.Ar <string>
+with the localised current time of day.
 .Ss Levels
 Each log message has a level as follows:
 .Bl -tag -width "xxx" -offset indent
@@ -242,7 +252,20 @@ other messages will be logged to syslog with priority
 .Li LOG_INFO ,
 and facility
 .Li LOG_USER .
-All other programs will log all messages to their stderr.
+.Bd -literal -offset indent
+[logging]
+	kdc = FILE:/var/log/kdc-%{strftime:%Y%m%d%H}
+.Ed
+.Pp
+This will log all messages from the
+.Nm kdc
+program with level 0 to 3 (inclusively) to a file whose
+name is generated using
+.Xr strftime 3 .
+As the file is
+.Xr open 2 ed
+each time a log message is written, this can be used to write
+automatically rotating log files.
 .Sh SEE ALSO
 .Xr syslog 3 ,
 .Xr krb5.conf 5
diff --git a/lib/krb5/log.c b/lib/krb5/log.c
index 1ee7daaa0..2b8dedf79 100644
--- a/lib/krb5/log.c
+++ b/lib/krb5/log.c
@@ -158,10 +158,8 @@ struct _heimdal_syslog_data{
 };
 
 static void KRB5_CALLCONV
-log_syslog(const char *timestr,
-	   const char *msg,
-	   void *data)
-
+log_syslog(krb5_context context, const char *timestr,
+	   const char *msg, void *data)
 {
     struct _heimdal_syslog_data *s = data;
     syslog(s->priority, "%s", msg);
@@ -206,15 +204,20 @@ struct file_data{
 };
 
 static void KRB5_CALLCONV
-log_file(const char *timestr,
-	 const char *msg,
-	 void *data)
+log_file(krb5_context context, const char *timestr, const char *msg, void *data)
 {
     struct file_data *f = data;
     char *msgclean;
     size_t len = strlen(msg);
-    if(f->keep_open == 0)
-	f->fd = fopen(f->filename, f->mode);
+
+    if (f->keep_open == 0) {
+	char *filename;
+
+	if (_krb5_expand_path_tokens(context, f->filename, 1, &filename))
+	    return;
+	f->fd = fopen(filename, f->mode);
+	free(filename);
+    }
     if(f->fd == NULL)
 	return;
     /* make sure the log doesn't contain special chars */
@@ -436,7 +439,7 @@ krb5_vlog_msg(krb5_context context,
 		else
 		    actual = msg;
 	    }
-	    (*fac->val[i].log_func)(buf, actual, fac->val[i].data);
+	    (*fac->val[i].log_func)(context, buf, actual, fac->val[i].data);
 	}
     if(reply == NULL)
 	free(msg);