To log source address you need to able to know it. This is not the case if you are not directly connected to computer that drop via ethernet. Thus this is the case for almost all internet IPs....
Logging the MAC address of the router can also be usefull. For example, if there are two routers on the network (each connected to different ISP), it would show from which router packets are arriving (usefull for debugging). It could also show if a station on the local network is trying to inject packets into an existing connection (OK, this is really a task for IDS tool, but anyhow).
With that in mind, I'd say that logging MAC address for all packtes has a value (as long as user is aware of couple of basic principles of networking).
-- Aleksandar Milivojevic <amilivojevic@xxxxxx> Pollard Banknote Limited Systems Administrator 1499 Buffalo Place Tel: (204) 474-2323 ext 276 Winnipeg, MB R3T 1L7
