The general issue regarding security and blogs seems obvious: Shouldn't logs be considered one element in security analysis ? - not something I see discussed in my short time here. Anyway, it gives me pause to think, "Where have I implemented log-analysis in my (or my cron's) routine... and planned for follow-up?"
Logging is an integral part of organizational security policies and best practices and well it should be. But don’t make the mistake of thinking that logging access to records is the same as securing them.
* Real-time security never gives complete coverage in an evolving electronic infrastructure ... there always are vulnerabilities that are patched, new services introduced whose risks aren't properly understood at first, etc. Having a log archive lets I.T. personnel look at history in case of breaches to find how certain data was leaked, or find what kinds of attacks were attempted. This history informs I.T. personnel how to improve their real-time security. It's an essential part of the feedback system.
* The most dangerous data theft isn't done by those penetrating a network from outside ... it's done by unscrupulous insiders who have some (needed) measure of access to the data. You need to trust someone. But they're not always honest. Trust, but verify. Archived log data is your only recourse here ... and knowledge that every move is recorded keeps insiders (if you choose to let them know) honest.
* Yes, log archives help prosecute bad actors.
Log data archival is a big commitment, will take tons of disk space and some expensive software (for a large corporation), and should be more than simply a data sink. To be effective you need to be able to continually run standard and custom queries to see what's happening in your network.
Aside from the obvious post-incident investigation, I've set up (nearly-) real-time scanning of logs feeding into programs that scan for abuse-like activity, and feed the output of those into alerting mechanisms and blacklists.
Those tools have proven time and again to be extremely valuable from a security perspective (we still log blacklisted attempts and can see what's trying and failing).