Scripting issue - Auth.log & Syslog copied over in middle of transfer

HI All - Last year I somehow created a process that midway through a transfer (get) via a script a process to copy the auth.log and syslog files over kicks off - then the get command completes. My problem is I can't remember how I did it and can't find any evidence of what kicks off the copy process.
Here is the script, but as you can see no mention of the auth.log or syslog files:
# Automatically abort script on errors
option batch abort
# Disable overwrite confirmations that conflict with the previous
option confirm off
# Connect
open tsmsched@172.20.1.10
# Force binary mode transfer
option transfer binary
lcd \\netapp-data\sftp_area
# Transfer Files from SFTP server to Secure Share
cd /sftp_transfers_from
get -neweronly -filemask=|From_Arandell\ *
# Transfer Files from Secure Share to SFTP server
cd /sftp_transfers_to
put -filemask=|To_Arandell\ *
# Disconnect
close
# Exit WinSCP
exit

Here is the behavior, it is walking through a directory transferring new files then grabs a copy of the auth.log and syslog and puts it into a local directory on the server:

onecall | 0 B | 0.0 KB/s | binary | 0%
onecall\From_Arandell | 0 B | 0.0 KB/s | binary | 0%
...\From_Arandell\mail | 0 B | 0.0 KB/s | binary | 0%
...\From_Arandell\print | 0 B | 0.0 KB/s | binary | 0%
southerntide | 0 B | 0.0 KB/s | binary | 0%
...\From_Arandell | 0 B | 0.0 KB/s | binary | 0%
...\From_Arandell\mail | 0 B | 0.0 KB/s | binary | 0%
...\From_Arandell\print | 0 B | 0.0 KB/s | binary | 0%
SFTP_Logs | 0 B | 0.0 KB/s | binary | 0%
SFTP_Logs\auth.log | 222120 KB | 17185.7 KB/s | binary | 100%
SFTP_Logs\syslog | 950673 KB | 15530.7 KB/s | binary | 100%
allant | 0 B | 15530.7 KB/s | binary | 0%
allant\From_Arandell | 0 B | 15530.7 KB/s | binary | 0%
...\From_Arandell\print | 0 B | 15530.7 KB/s | binary | 0%
allant\From_Arandell\mail | 0 B | 15505.6 KB/s | binary | 0%
iddata | 0 B | 15505.6 KB/s | binary | 0%
iddata\From_Arandell | 0 B | 15505.6 KB/s | binary | 0%
...\From_Arandell\print | 0 B | 15505.6 KB/s | binary | 0%
iddata\From_Arandell\mail | 0 B | 15479.0 KB/s | binary | 0%
umsmail | 0 B | 15479.0 KB/s | binary | 0%
umsmail\From_Arandell | 0 B | 15479.0 KB/s | binary | 0%
...\From_Arandell\print | 0 B | 15479.0 KB/s | binary | 0%
...\From_Arandell\mail | 0 B | 15452.5 KB/s | binary | 0%

I remember why I did it - just found a better way and now need to kill the old process....
Any ideas would be appreciated - I'm fresh out. It starts the copy process at teh same point in the transfer every time - it almost looks like there is a trigger in that folder that kicks off a secondary process - but I didn't find anything.

Please attach a full session log file showing the problem (using the latest version of WinSCP).