Sometimes I just sit and stare at my apache access logs because I’m bored
GoAccess is pretty nice for a broad overview of Apache logs, also.
For other services I generally just look at them every now and then and if something looks off I investigate. I found a cryptominer on my network once because it was spamming DNS and that shows up in DNS logs.
I couldn’t give a Windows PC to my grandparents, either, though.