Yes, that's typically the way to do it. Or you can just roll your own. All this module does is send a cookie with a unique ID to anyone who comes in without one. Then you use a custom log format to log the cookie as part of each access, giving you a unique ID to trace. People can still browse the site if they don't accept the cookie, so it's not a terrible thing to do.