on *NIX i do this... write a daemon that uses File::Tail to get lines from the log, then if it's something that can be handled locally (update filters, nice a process,...) i handle it then and there. if it's something that needs action at a distance i send the info into a database (mysql with SSL authentication) and have another process somewhere that checks the db entries and takes appropriate action.

OT: now if Juniper would fix their routers memory problems i would be quite happy. i'm watching logs on various machines and blocking evil-doers at the border pronto.