[jedberg]

> Log retention is also directly tied to how fast and easily can you detect and recover from issues.

I disagree. Every issue I've ever debugged, I did a tail -f on the logs. I can't recall ever searching the old logs.

Even if it takes a few days for an issue to brew, usually the logs right now will show the issue. Or if they don't, then you can turn on the logs and have them in a few days time. It's so rare that it's almost never worth keeping the logs around just for that one case where an old log might lead to resolution, and rarely does one have time during an active incident to look at old logs anyway.