[Serusers] Accounting tools or ideas needed

We are generating accounting records for INVITE, BYE and CANCEL methods. We use flatstore and rotate the files nightly via cron.daily. We expected the number of each type of record to "add up". That is we expected each INVITE to have either a BYE or CANCEL based on the Call-ID field but we are actually getting duplicates and in some cases seem to get BYEs without a corresponding INVITE. I think some of these BYE may be for calls initiated by the proxy to either our Asterisk voicemail server or to another UA because of blind transfers initiated at the phone or call forward always initiated by the proxy. The trouble is we have 600+ subscribers and the logs are huge. I have used cat, grep and sort to try and identify the mismatch but this is tedious at best. Does anyone have any insight into why the mismatch might exist and suggestions for record matching based on the Call-ID field. We are using ser 0.9.7-pre3, Cisco 79x0 phones running 7.3 image and Cisco 2821 gateways running 12.3(8)T11. Thanks,Steve