Four servers, eleven log files, and an incident reconstructed from three of them. Shipping first and parsing second, structured events, and the correlation id that makes it useful.
A shipper that follows a file by descriptor keeps reading the rotated-away file and never sees the new one; a shipper that reopens by name misses whatever was…
The modules are idempotent and shell and command are not, so a playbook that reaches for them loses the property the tool exists for — and reports “changed”…
Environment variables are the standard place to put configuration and they are readable by anything that can see the process — including, on many systems, other users. The…