When logs from several servers are compared side by side, timestamps are often used to reconstruct the incident. If the clocks differ, however, a later event can appear to have happened first. Sorting timestamps is not enough to prove causal order.
Logs are useful for future investigations, but unlimited retention can let the evidence system consume the resources required by the service itself. Observability needs its own storage budget.
Making log shipping visible in the deployment model rather than treating logs as an afterthought.
Separating application logging from the system that moves or ingests those logs.