I worked at a firm in 1999 as IT manager... the director required our syslog to be piped out to a line printer printing a real-time physical copy of log/messages and logwatch output on our linux machines.

I was required to manually go through each 24-hour output with a highlighter and look for attacks....

This was not a fun part of my job.