I find that it is “a very good thing” to capture historical data like this in SQL databases ... and I usually use good ol’ SQLite for this. (It is a great way to produce “a flat disk file” that you can query.)
However, in your case, I agree that you should look at existing log-analysis programs first. “Do Not Do A Thing Already Done.”
My “gut instinct” with regard to this particular case is: do you have a load-balancer? Is there anything, hardware-wise, sitting in front of these servers and apportioning the traffic between them? If so, it is very likely that it is dispatching the traffic in an unfair way.