Centralized Logging -- Single Point of Failure?

[Peter Schober]

* David Langenberg <davel at uchicago.edu> [2013-05-06 18:34]:
> If you're centralizing your logs via UNIX syslog, then you shouldn't
> have anything to worry about.  Syslog is a send and forget protocol
> which works over UDP.  If the log message doesn't make it to the
> syslog server, the node really doesn't care.  So, I'd recommend
> using (in addition to the syslog appender) rolling-file-appenders
> with sensible rotation policies on the nodes themselves to ensure
> disk doesn't fill up.  If the central log server dies, you'll still
> have copies of the logs locally.

ACK

The situation does not really improve by switching to TCP delivery
either (but may help increase the load on the central syslog daemon):
http://blog.gerhards.net/2008/04/on-unreliability-of-plain-tcp-syslog.html

Remote logging is certainly more convenient, might have very slight
security advantages (compared to only local logs, which might already
have been "cleaned up" after a security incident) and will be good
enough for common cases, so you don't have to go chasing logs on
several machines when troubleshooting.
But if you wanted to be sure you have the whole picture you'd still
have to grab the local log files from each server regularly.
-peter