syslog isn't an observability system, you're right. It's just a transport. It doesn't really care what it transports either, delimeted, positional, structured -

syslog isn't an observability system, you're right. It's just a transport. It doesn't really care what it transports either, delimeted, positional, structured - it'll transport it all. It'll do it durably, accurately and reliable with very modest systems at millions of messages a second. The goal is to get it to the right place for the observability systems, and to feed them reliably. We keep local logs for 24 hours, a sideline feed to S3, they then get sent to multiple multiple systems for tracing and legal and audits and siem etc etc. It's not trying to be a foglight or datadog, it just helps enable them. Apologies for being argumentative, but I come into orgs who make these generalizations, and I discover (or they engage me) because they've missed critical logging paths and face legal and compliance or intrusions and want to build more robust logging. Otel is certainly part of it, but writing off syslog because of configuration options that aren't durable etc, when that hasn't been the baseline in decades - well, it keeps me employed at a high salary because I see this often