They use the server logs themselves. Every time you request a page from a server, an entry is placed into a server log file. On-server statistics process those files.
The data obtained is sometimes limited and misleading. For example, bots can be hard to distinguish from human visitors; something which javascript-based systems do almost automatically. On the other hand - they do pick up bot activity - something which javascript-based systems miss.
