I hate the idea that logs are reality, people often trust their logs, and are willing to grab logs then reprovision a server

I have a favourite day when my logs showed a remote root login

After an hour of tracing, going on the box itself, turns out systemd had sent old logs