Only the connection history - hostname and date/time of access, and only if authorised for an investigation.

It's akin to the phone companies logging each number called. This isn't as intrusive as people are making it out to be.