Neil,
Assuming some flavor of Unix...if not disregard.
You could pre-process the file with the uniq command which should
compress any concurrent entries in the log file into one line. That might
significantly reduce the number of lines you need to process. Then building
a hash of your opens with a value of 2, and testing your working settings and subtracting 1, (new value in hash is 1), then process your closes setting the
value of the corresponding open hash to 0 (subtract one again) might be workable. That way you would know what was opened, worked on, and closed, and it could be a one pass thru the file thing.
Just a thought.
tim