Sometimes I just sit and stare at my apache access logs because I’m bored
GoAccess is pretty nice for a broad overview of Apache logs, also.
For other services I generally just look at them every now and then and if something looks off I investigate. I found a cryptominer on my network once because it was spamming DNS and that shows up in DNS logs.
Cheaters battle each other all the time, deliberately, in private matches. The reason it’s not a sport with spectators is likely because if you’re a known cheater then you’re stuck with that label forever no matter what you do.