Simple Anomaly Detection Using Plain SQL
While this is all good, very few places AFAIK actually process their HTTP server logs into a form that can be queried by SQL. Google does it, certainly, but many smaller shops don't. Has this been your experience as well?