Unless you've got an explicit "logout" action you're never really going to know when the session's over. The simplest thing might be to write an log_for_date( ) sub which returns a filehandle for a pre-trimmed logfile for the date in question, which you'd then search for the specific terms. That sub is responsible for locating a pre-existing version if possible. You'd then setup a cron job (or fork a process after you've returned your results to the user) which leans up any logfiless that haven't been accessed in more than n minutes (or hours).

Another approach requiring a bit more complexity would be to build an index of (date, tell offset) for each line in the file and use that to jump to points of interest rather than slogging through the entire file every time (in fact this might be a good place to use an iterator, for the HoP-inclined).

Or look at the Cache hierarchy on CPAN.