ansible-hardening/doc/source/developer-notes/V-38520.rst

Exception

At the moment, openstack-ansible already sends logs to the rsyslog container from various containers and hosts. However, deployers are strongly urged to forward these logs to a system outside their openstack-ansible environment to ensure that they cannot be altered.

Some compliance programs require centralized logging, including PCI-DSS.