Over the last few days I've been playing around with analyzing and graphing the proftpd and Apache logs from University of Cape Town Linux Enthusiasts Group mirror server for a report I am writing. The data is incomplete but what we have looks quite impressive - and this is only data to UCT IP addresses, not any off-campus data. We have a lot more log information for ftp - incomplete but going back as far as 2000. In the past, ftp was the way things were done. We installed linux using a network install over ftp, and we used ftp to fetch updates. Times are changing. These days everything is http. Instead of doing a network install (does Ubuntu even support a network install?) we download the ISO (via http!), burn it and install that way. And, of course, we do updates over http as well. It is a pity we don't have more data on http and it would have been nice to see where the change happened. I wrote the scripts to analyse the logs using python . I got to use pyparsing to pa