I suppose it depends on what check plugin you are using. I like the one that will read the live log file you want to check and search for "string". If it finds "string" then it will alert you. The check doesn't copy the log file or anything, it just does a read. It then creates a bookmark that it saves to wherever you tell it, I use /usr/local/nagios/var/. The next time it goes to read the logfile, it starts where it left off, by looking at it's bookmark file, that way, it is very efficient. So try them all, find the one that makes a bookmark.