If you have a competent sysadmin (or if you are one), servers keep logs, and they should be available to you for free.
Server logs will tell you what pages visitors have visited, which pages they came from (including, if they came from any search engine other than duckduckgo, you will see also their search terms), what user agent they are using (or, what user agent their browser claims, since browsers can and do lie), what time they visited, and what status your server served the pages with (handy for catching errors you didn’t notice).
Server logs I don’t believe will tell you how long someone was on a page (because the UA makes a request and your server simply serves and is done), won’t tell you if the user has Javascript enabled or Flash player installed, nor many of the other juicy stats you may want.
The web analytics stuff you see available online usually rely on Javascript to run scripts that track users, and can tell you a bit more information about what they are doing while on your page. Remember time spent on a web page doesn’t necessarily mean users are actually looking at that page… they may have opened a new tab, switched to some application running on their desktop, or walked away for a cup of coffee or stopped the kids from burning down the house. However, people leaving within 5 seconds is nice to know, since these are people who arrived at a page and immediately knew it didn’t have what they were looking for.
An example of free web stats you can find online (which my husband has used so I can at least say they are not total crap) is AW Stats. Like most of these online stats things, their main job is making your data look pretty.
Anything that uses both Javascript, a backup image, AND server logs together would be a very nice stats package indeed, because your server will record anyone without Javascript running, including bots.
Maybe what you’d want to do is start out with a free stats thing until you get a feel for what kind of data you want/need, and then wherever the open source or free versions fall short, you know what to look for/ask for when (possibly) upgrading to some paid service. A paid service worth anything would have maybe more algorithms for analysing your data better or something.
Store your data in some format you believe you’ll be using for a long time, so that if you change stats-programs you can somehow merge your old and new data well together.
Mm, that’s about the end of my knowledge, and even then a lot of it is pretty-sounding speculation : ) At my company they use a paid service called OneStat, which my boss was angry he couldn’t log into via his mobile phone because they (stupidly) required Javascript simply to log in. Which is retarded and unnecessary. Logins/logouts are a client-server conversation, JS should never be necessary. Beware any stats programs that hijack users’ communication with your servers simply so it can measure them… stats should passively watch users and their Javascript should be unnoticeable to users.
You didn’t mention usability testing but, as a business you want to know what your users are doing… and so testing your pages is always awesome. Just 5 people (who do NOT have to be your target group) given a few tasks by someone who’s familiar with usability testing (how not to screw it up) can and will show you where your pages are failing your users. Even good pages have problems. When the biggest and easiest-to-fix problems are found by testers, you can get them fixed and UNLOCK A NEW ACHIEVEMENT IN AWESOME.