[b5n]

I usually do it all in awk:

    awk '/mail/ && NR <= 500 {...}' access.log

If you want N matched lines:

    awk '/mail/ && i < 500 {i++; ...}' access.log

[matvore]

I wish I knew awk as well as I know perl, since then I wouldn't need to hear recommendations for CPAN modules and spurious style prescriptions.