Your "hits" comment I find interesting. Do you really want to stand behind the opinion that people looking at server logs are just counting hits?
I think I've made it crystal clear throughout this thread. Raw log files are useless due to spoofed headers. Individual user behavior can be easily missed while going over mountains of quantified daily/weekly/monthly data.
Real time tracking (in addition to server logs) is the only way to go nowadays... good luck pin pointing the zombie problem using your server logs alone...
It is only via real time tracking that i discovered that i often get bursts of smartphones users throughout certain times of the day or the fact that some bots masquerade as browsers.