As a general rule, I will have most of my app and system logs sent to a central log aggregation server. Splunk, log entries, even cloudwatch can do this now.
But you are right, if there is an archaic server that you need to analyse logs from, nothing beats a find/grep/sed