An application writing to both, which doubles the disk and halves the usefulness of each.
stdout collected by the runtime, shipped to the
log store, structured, queryable
a file inside the container, rotated by a
logrotate rule on the host that cannot see
it, growing until the container is replaced
and the two are not identical: the file has the
framework's default format and stdout has ours,
because two channels were configured independently in
2021 and 2023.
the file was 4.1 GB.
A container writing to a file is a container whose logs disappear when it is replaced, which is either fine or a serious gap depending on whether anybody knew. The two formats diverging is the more interesting finding — a grep that works against one produces nothing against the other, which had confused an investigation in February.