I use centralized logging with rsyslog, which means that there are dedicated logging servers which collect syslog messages from all servers.
All inspections of logs are done from those logging servers, which means that system administrators never SSH the machines themselves to view the local
In order to (slightly) reduce disk usage, I think that it could be a good idea to disable local syslog.
How do I do that? Is it enough to just remove the
$IncludeConfig /etc/rsyslog.d/*.confline from
And more importantly, are there any drawbacks or risks of doing it? I recall reading that when centralized logging is used, some log messages can be lost (I'll check if messages were lost for a few weeks by comparing local and centralized logs to check if this is the case here.) Are there other risks?
Note: if it matters, the distribution is Ubuntu 14.04, but I'm interested in answers for other distributions as well.