I've used log files extensively for security. Aside from the obvious post-incident investigation, I've set up (nearly-) real-time scanning of logs feeding into

I've used log files extensively for security. Aside from the obvious post-incident investigation, I've set up (nearly-) real-time scanning of logs feeding into programs that scan for abuse-like activity, and feed the output of those into alerting mechanisms and blacklists. Those tools have proven time and again to be extremely valuable from a security perspective (we still log blacklisted attempts and can see what's trying and failing).