Why is tracking if done by the police in a "slow" way (ie: cops sitting at major intersections or keeping an eye out for a flagged vehicle) OK, but if it is done automatically somehow bad?
Should all of your server logs be manually reviewed by hand for intrusion detection vs. allowing software to do it? You are both trying to track down and also stop criminals...