The invoice went up around 38% in one quarter and the meeting already had a culprit: the AI feature that shipped in April. Two more instances were on the table. Before approving them, I asked for something cheaper than a server, which was read access to seven days of access logs.
The answer took an afternoon. About 63% of the summed backend time in that week went to clients that arrived with a Chrome user agent, requested only HTML, never fetched a single stylesheet, and never came back to the same address twice.
Here is exactly what I ran, including the two things that did not work.
Your log format is probably missing the only field that matters
Most nginx setups still run the default combined format, which gives you status, bytes and user agent. It does not give you time. Without time you can only count hits, and hit count is the metric that hides this problem, because the cheap route wins on volume and the expensive one hides at the bottom of the list.
