Not that this answers your question, but I use Apache (and it's mod_proxy) as the first line reverse-proxy server. It can be configured to produce a seperate log file per site, and there are many different log analyzers that work well with Apache logs.
As to your situation, my approach would be to write a perl script to split the file into a seperate log file for each subdomain and run webalizer on them. That way you can also keep your single log file and keep producing the whole-server stats you have now.
