Pretty neat! I wish it was access log based though. Using the access logs means being able to see anomalous activity such as spikes in particular status codes, performance issues, that sort of thing. I do have a project I could use as the base for that, but I suspect I might be one of the few people who cares about that sort of info.