As a follow up to what Masem proposed, this is a code snippet that I used to monitor my Squid cache performance: 

#!/usr/bin/perl 

package DateParser;

use Date::Manip;
sub date_mangler {
        $arg = $_[0];
        $times = $_[1];
        $seconds_gm = time();
        $some_day = localtime($seconds_gm);
        $parsed=&ParseDate($some_day);
        $epoch = &UnixDate($parsed,"%s");
        if(not defined $times) { $times = 1; }
        if(not defined $arg) { $arg = 'default'; }

        if(($arg eq '-min') or ($arg eq '-MIN')){
                $epoch -= ($times *60);
        }
        elsif(($arg eq '-hour') or ($arg eq '-HOUR')){
                $epoch -= ($times * 3600);
        }
        elsif(($arg eq '-day') or ($arg eq '-DAY')){
                $epoch -= ($times * 86400);
        }
        else {
                $epoch -= 86400;
        }
        return $epoch;
}
1;

[download]

A little background: Squid uses epoch time (seconds since epoch) as the date format. Calling DateParser::date_mangler (I tried hard to think of a better name, I promise ;) gives you the minumum number of seconds for the date metric (minute, hour) passed in as a parameter.

Thereafter, simply pick all the lines that have a date stamp larger than the one returned from this function..
HTH, and as always, comments on code much appreciated..

Update:File::Tail is exactly what you want for your job, as noted by others. My procedure is used to do analysis on static files that have already been rotated.

In reply to Re: Tailing the access log by tinman
in thread Tailing the access log by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.