Logging throttled IP's

Not a file, you need to log to your syslog deamon, via unix or udp socket. Like this: