I like this problem.
Personally, I would keep a hash of filehandles, but close one at random if there are too many open (hoping the pids are kinda grouped together in the logfile).
use strict;
my %handles = ();
sub open_one {
my $pid = shift;
return $handles{$pid} if exists $handles{$pid};
while( (my @k = keys %handles) > $threshold ) {
my $toclose = $k[ int rand @k ];
close $handles{$toclose};
delete $handles{$toclose};
}
open $handles{$pid}, ">>", "logfile-$pid.log" or die "hrm: $!";
return $handles{$pid};
}
sub scanner {
# ... boring things
if( m/something/ ) {
my $pid = $1;
my $fh = &open_one($pid);
print $fh $stuff;
}
# boring things...
}