Please consider to add an option to support the monitoring of pruned logs.

Without such option it can be hard to monitor for example log files from IBM TSM Backup-Archive Clients.
These clients allow an option to prune log entries older than a specified number of days, what may lead to a lower log file size - thus by Zabbix seen as new file/data.

Details about the mentioned "schedlogretention" option may be found here:
http://publib.boulder.ibm.com/infocenter/tivihelp/v1r1/topic/com.ibm.itsmfdt.doc/ans50000366.htm?path=1_1_2_12_120#opt6076

One idea to achieve this in an efficient way could be to use binary search for evaluating the original end of log file:
https://en.wikipedia.org/wiki/Binary_search

The search "key" could be 'Local time'. Thus the following preconditions should be met:

• Item has "Log time format" set
• Last 'Local time' value is known.
• Log size is lower than lastlogsize but greater than 0.

Caveats:
For cases where same 'Local time' may be evaluated between check intervals one has to decide between:

• miss entries (beginning after the last occurrence of a key hit)
• duplicate entries (beginning after the first occurrence of a key hit)
• undefined/both (beginning after first key hit)
• and maybe others...