Two points.

First, File::Tail rocks. Get it, use it.

Second, you keep using the word "user", but I don't know how you can know that, unless every user is being tracked by a unique cookie or something. I'd certainly hope you aren't confusing the words "IP address" with the word "user", because they are not the same. Many users share the same IP addresses. Many users have multiple IP addresses. An extreme case of that is the largest single group of internet users in the world: AOL. A single page hit from an AOL user can appear to come from many proxy servers.