I run a VPS which has numerous sites on it. Whilst I was trying to pin down the root cause of sporadic hard lockups and runaway memory usage, I settled on a somewhat inefficient (yet very handy) line of code which I run inside a tmux session over a PuTTY SSH connection (two other panes run iftop and watch --interval=0.1 iostat -m for realtime disk I/O).
An aside: tmux is like screen on speed, way more extensible and SO MUCH EASIER TO USE, I highly recommend you give it a try if you're a commandline warrior. There's some highly useful tutorials to help you get up to speed - google "tmux tutorial", Hawk Host's two-parter has some good stuff in it.
To accomplish this I'm taking advantage of the fact that DirectAdmin (which by default provides a base of Apache 2, MySQL and PHP 5) stores its httpd access logs in a common folder: /var/log/httpd/domains/<virtualhost>.log</a>. I'm combining the tail command with grep's egrep functionality (grep -e) and some pattern matching. It's not perfect: I have to occasionally Ctrl+C and restart the command as it stalls out, but it does everything I need.
Full command and my somewhat explanatory breakdown after the jump