(Sometimes late to the party ) )
Back in 2002 I was speaking at conferences and received evil stares when I stated that I worked on the running system, gathering information of interest and that live analysis was something that shouldn't be ignored.
There was a little grin on my ugly mug in 2005/6 when Eric Thompson from AccessData spoke at a conference and told his audience something along the lines of "If you're not grabbing information from a running system you may very well miss what you need". Took a couple years but from that point forward it seems the commercial companies started listening and putting applications out, updating training, etc.
That being said, I can't remember I time when I did act on the live system and gather information from memory. Going back to my Red Hat days in 2001 and prior.
It's been around for a long, long time. )
Cheers!
farmerdude