The goal is to: * limit the amount of (potentially) PII data by limiting retention time * make sure the disk doesn't fill up with log data * make it easier to look at logs on the system without having to wade through many old entries
We don't want hour journalctl logs mirrored to /var/log/syslog