Frank_Rizzo - 7:40 pm on Feb 2, 2010 (gmt 0)

I use something similar:

netstat -a -n | grep :80 | cut -d : -f2 | awk '{print $2}' | sort | uniq -c | sort

This shows the active connections on port 80 right now / within the timeout parameter.

This method would not need to scan the log file so you should be able to cron it at a faster interval.