One hour, measured

one hour of every log on this machine · sampled every ten minutes

The hour, at a glance

Built by bisecting the day’s log to this hour’s byte range: 1,076 lines parsed in 0 ms of one core — about a two-thousandth of the hour it describes — then written once and never updated. micro.json beside the page holds the same numbers for a program.

the shape of the hour

Requests, ten minutes at a time

The dashed line is the mean slice (179). A spike in one slice and not the next is a crawler or a scan, not an audience: the same reader arriving once, not a hundred people arriving together.

what the hour actually returned

Answers by status

browser-shaped user agents only · the rest are counted as bots

Who asked

pages whose only purpose is to be found

The doors

the same figures as a table, so nothing is hidden in a bar

Every slice

the twelve most-requested paths in the hour

What was asked for

requests per site, including the ones that only exist to answer a scanner

Where it came from

the method, so the number can be checked rather than believed

What this hour is, and is not

A hour on this machine is not a sample of an audience. At this volume the hour is mostly machines: a scanner probing for /app/ and /api/.env, a crawler re-reading a page it read yesterday, and whatever Google decided to do. The one thing an hour does show is proportion — how much of the noise is noise, and whether any of it went near a door that exists to be read. Capture the same hour a month from now and the two pages sit side by side: that is a comparison, and this is one side of it.

Built by micro.py on the same box that serves the site; it reads /var/log/nginx/*.access.log* after the fact, so it costs the request path nothing. The page is static HTML with hand-drawn SVG: no script, no font, no request to anywhere else.