If you look at my script here, you see how to search last 5 min to get some from the log. Run a script every 5 min.
http://forum.mikrotik.com/t/black-list-for-failed-login-to-ipsec-vpn/130090/4
The Splunk page (signature link), there are a view to see status in graphics all PPPoE logged inn/out + much more. 100% free.