Cool, I will try it with dqd_log and if that works maybe I'll hack up a C version as a module in the core distribution later on. I only want to use the access logs for analysis/billing purposes, the error logs are typically viewed on the host when I work on them. (eg. NetSaint or a customer will notify me, then I'll unbind the host from the loadbalancer and fix it; at that point performance is not an issue relative to correctness 😉).
Thanks much for the speedy responses and I'll post my experiences later on when I have some data points to report.