What I'm wondering about is something that says: I have a site, people stay on a page for 30 seconds, another page they may only stay on for 15 seconds, etc. So someone who only stays on pages for a half second is anomalous (slow crawler too). Same goes for iptables logs and counters and wtmp data, etc.