Virtual servers can be connected to physical drives, but that severely limits their mobility. So most often, virtual servers run off virtual disks that live in a SAN or file server. And since most operating systems store logs "locally", all the application, OS and logs stay in the virtual disk. But unlike "real" servers which take time to rack, build and unrack, virtual servers can be built and deployed at a click of the mouse. So they are built and deployed, sometimes hundreds or thousands of them. Because of the ease of deployment, throwing a virtual "test" server into the data center to test out a specific configuration or test a patch is a piece of cake. Once the test is run, the virtual server has no further use and may be deleted. Or it may hang around on disk forever, only to re-surface months later. Servers become a transient phenomenon, whipped in and out of existence easily. All the data that is stored in their disks, all that troubleshooting, forensic, audit and security critical information is like footprints on the beach, melting away with each wave.
System administrators and operations teams seem to be stuck with two choices: Scavenge the transient servers so as the keep a clean environment and potentially lose some of the logs, or let them pile up and keep them forever "just in case". Neither option is very appealing. A better way is to keep a clean house and delete virtual disks that are not in use, but to off-load all the transient run-time data, logs and configurations. Virtualization can give us the freedom to treat servers as fleeting images that come and go, but we need data management and log management solutions to protect the footprints from being washed away.