[jldugger]

> who's actually looking at this?

Well, your security team, post incident. But also automated systems like fail2ban.

[warrenm]

And log-collectors like Splunk (with configured alerts, etc)