So there are quite a few things you can do. Like AviD said you really need to know what your goal is with the honeypot before you even set it up.
Watch behavior. Depending on the type of honeypot you have, you may see certain types of behavior that you can use to characterize the person attacking you. For example...If the attacker always sends 1 ICMP packet as if they ran the command
ping -c 1 x.x.x.x. Or if you have a higher interaction honeypot, if they constantly run the
ls command...quirks like that. If the attacker returns then you may be able to recognized him based off of these.
Big organizations who deal with huge numbers of attacks (and successful attacks) will sometimes build honeypot networks that they put compromised computers into. They watch the attacker and figure out what they may be after, what their goals were, and who they might be. This may help you decide if changes need to be made to your security policy.
If they are really crummy you may be able to figure out who they are (I've seen this happen often with botnets). Do with this information what you like...Build a court case or whatever you want...
If you were asking more of a technical How to sift through logs then you will need standard linux command line kung fu. Grep and awk are youre friends. Or you can use a tool to build a timeline like Zeitline or some other one.
Your course of action really depends on the data you collected. If there is IRC traffic then of course you want to investigate it. If you discover executables downloaded then you want to investigate that. Literally everything that is out of ordinary you want to investigate. tcprelay and security onion may be really really helpful in figuring what happened because it will help you create a timeline and see everything you asked about.
Hope I was helpful.