There are lots of examples where you'd want to log the alert thrown to the user in just a single step. To name a few:

* un-authorized access to a certain entity
* failure to export/zip
* brute-force protection initiated on a given IP