Just to follow up on this for posterity, I adapted the "sliding window" technique using sysread to read in 16K chunks, and then crawl through them with index() looking for lines that I should check more thoroughly. After some tuning, this provided about a 300% speed improvement. Good enough, and not that much effort required.