What do you mean? That has described the vast majority of Linux systems I have ever touched, professionally or personally. Even corporate environments with log aggregation tail system logs rather than having them directly shipped elsewhere. The rare exceptions to this are some embedded devices without much durable storage, or tightly regulated environments in which log data is considered radioactive.
I’ve met people that think the log should be remotely stored and not written locally, since it’ll be shipped to splunk or whatever anyway.
Those people change their minds the first time a machine has intermittent network issues, and the logs needed to debug it are lost (or worse, the log buffer fills, then stdout fills, which backpressures the application, creating an outage while simultaneously eating the logs).
By count, most installs will be the large cloud providers
Agreed. And in my experience , most large cloud providers’ Linux systems I’ve worked on (either their VMs as a tenant or their underlying hardware as an employee) log locally and ship additionally.
We did a small amount of system logs, but anything high volume went directly remote