If someone does manage to compromise your box, you'll want to be notified. You'll also want a way of double-checking if you suspect a compromise has occurred.
Balance is the key to logging.
You don't want so much information that you are flooded with information you cannot process. You will also want to archive these logs in a single file for later reference. The second log, with more detail, will generally not be analyzed unless you believe a compromise has occurred. From it, you will hope to gain some hint of the events leading up to the compromise. You might want to log critical notes to a printer or to a separate logging host, set up for that purpose.