I worked this out the other night before doing something similar for a log monitoring utility we use at WMF. It could use some improvements, and ideally it'd be a general-purpose utility, but might as well capture this version here.