How to monitor logins to Screen Sharing and SSH?
Yes - it would be more efficient to tail -f the log file so that your script only has to parse each line in the file once rather an once per interval. 

Of course, you then still need to write and test the code to monitor for times when the logfile gets rotated and perhaps double check at you didn't miss an event by scanning the entire new file once when you first attach to that file. 

What is best is a trade off between your comfort level and your skills. It MIT also make sense to sniff the network traffic since screen sharing listens on known ports, or you could monitor for new processes listening on new ports or you could turn on process auditing and monitor those logs or you could parse the process table. There are many ways to skin this cat.