Ideally you stream logs and try not to rely on local storage. Rsyslog is quite the work beast and has a multitude of useful features (e.g. tcp+round-robin-multi

Ideally you stream logs and try not to rely on local storage. Rsyslog is quite the work beast and has a multitude of useful features (e.g. tcp+round-robin-multipath transfer mechanisms, disk-backed queues, rate limitation) and if you're feeling it, writing extensions is not that hard. Just reading all the docs is mind-boggling...