we are using check_log from the nagios-plugins to monitor logs, but the problem is that with big logfiles, even if we rotate logs hourly, the plugin causes significant spikes in memory and cpu usage.
That is because check_log is using diff to compare an old version of the log file with the current one.
Question is, without having to check the source of all check_log alternatives, is there any that doesn't use diff but for example follows the last checked linenumber and picks up checking from there?