Trivial, maybe. Not only does it add a single point of failure, though, as the logs get aggregated on the syslog host, the only “benefit” rtail retains is looking at the logs in a browser instead of tail(1).
Not sure why syslogd as a single point of failure is worse than rtail-server being a single point of failure- there are some very, very stable & battle-tested syslogd implementations.
Additionally, it doesn't really seem like that's the case- as long as you were willing to reconfigure syslog on the hosts, you could do syslog -> rtail => rtail-server (-> is local, => is network), as rtail works via UDP.
Additionally, it doesn't really seem like that's the case- as long as you were willing to reconfigure syslog on the hosts, you could do syslog -> rtail => rtail-server (-> is local, => is network), as rtail works via UDP.