Good for your personal devices, very not good for servers where you need to have any sort of accountability and security trail.
back
1 comments
That’s why you ship the logs off host to a central collector.
Nice in theory in practice you always retain them locally as well, just in case the network connection goes down.
If network egress fails and logs are pushed in real time over a connection with no local backing, you face an ugly tradeoff: either drop log data silently (loss of visibility during the very network partition you need to debug) or apply backpressure to services (potentially hanging applications when logging buffers saturate).
Agreed. That's what the log agent's disk buffer is for. That can still be used even if the journal itself is on volatile storage.