Can't you just use -i and specify a checkpoint file with Logparser to do what you want (incremental updating)? I seem to recall reading it works on IIS log files (I use it all the time for creating NT ...