You're of course right.
But also, are you shipping all the logs? Of course you're shipping application logs somewhere searchable, what about gc logs, syslog, kernel logs, etc? Is it never necessary to run ad hoc commands on your production systems?
But also, are you shipping all the logs? Of course you're shipping application logs somewhere searchable, what about gc logs, syslog, kernel logs, etc? Is it never necessary to run ad hoc commands on your production systems?
> "Is it never necessary to run ad hoc commands on your production systems?"
Ad-hoc commands in production AS ROOT should be exception, not norm, and reserved for on-call members, not every developer working on team.
Even the most competent people, sysadmin or developer, can make a mistake.
I did not say no commands should ever be run on production, there could be non-root read-only accounts. I am opposed to everyone having root on production. I have seen enough data loss incidents or full blown outages because of mistakes.