As a developer/consultant, I’ve always used the log.nsf to help research issues in a production environment. In R6 this d.b. was tightened down and by default, people don’t have read access.
What is the best practice approach regarding read access by developers for the log.nsf d.b.'s in production environments? Before R6, this was not an issue… everyone had read access. Is there a higher security risk with developers reading the log.nsf now in R6 than there was before the R6 release?
Subject: we have seen this a lot in productive systems in R5…
specially in R5 on Unix/Linux systems where admins missed up the ACL in the very beginning and had no tools to fix the ACL (because there is no Notes client for Unix). So the ACL was still the default which gave reader access to everyone.
So even the Admins had only reader access to log.nsf. This is over now because you can use the FullAccess Administrator to change the ACL 
IMO reader access for everyone is a security problem because log.nsf provides a lot of information about the system and also activity data for all databases and users!
I would suggest that you have it at least restricted to the admin and developer group. As already said in this forum developer access to log.nsf is a gray area.
In most cases developer access to log.nsf makes sense. But in some companies (mainly large companies) where paranoid admins take security very high developers have no special access to productive data at all.
Ingo Erdmann from University Parderborn and I did a session about “Developer and Administrator collaboration” (“Domino Administratoren und Domino Administratoren - Gegenspieler oder gutes Team?”) at Admin2003 here in Germany. The title was German but the slides are English. I cannot post the slides in public but I can send it to anyone who is interested offline. Just drop me a short mail and I will reply with the PDF.
Subject: The ND6 Admin Client is nicer for maintaining the ACL, but
It is still not as easy as it should be.
Maintaining the ACL and Adding a group to multiple DB (such as the LocalDomainAdmins) can still be a big job. Our Workflo!ACL Manager allows the ADmin to view the ACL of all databases (similar to the catalog) but then select databases and make a batch update to them. downlaod a demo from http:/www.wfs.com
Subject: RE: Question for Thomas Gumz & the Notes Admin world
Access to log files should be restricted to only admins and developers. Ordinary users should never have access to the logs, which is why R6 locked it down by default (and what R5 should have done long ago). If you need to grant access to developers, create a group for them and grant access to the group, but leave default access at No Access.
Subject: RE: Question for Thomas Gumz & the Notes Admin world
/agree that
Subject: Agreed
Subject: Agreed…what Eric said
We introduced a new system group called “LocalDomainAdmins” in R6, which has the appropriate rights to all system databases. We didn’t do it for developers, since this is a grey area, so feel free to create your own “LocalDomainDesigners” group or something like that…
Thomas - IBM
Subject: Thomas made sure that the complete ACL of all templates had been cleaned up in D6 – huge thanks!
ACL of templates was a big deal in R5 and this is now fixed in D6 :-)All templates have proper ACL and the LocalDomainAdmins which where used within IBM for a while have been introduced in Domino 6 as a standard.
I was so happy to see this because it prevents also security problems and problems with replication of templates. You now don’t need to worry any more if you install templates on a server
Huge Thanks
Daniel