• Could we match on service, to make it clear this is basically the same thing we're doing with cockroachdb above?
• How much of this is "NTP-specific"? E.g., why not grab service_logs.extra as a catch-all for all services?

It does match on the service being ntp, but I will add the filter to make sure we are only grabbing those files for now.

I have been treating things in extra as a case by case basis. For example the log file names in cockroachdb look very different from the log names of chrony.

I mean we could do:

match service {
  "cockroachdb" => ...
  "ntp" => ...
  _ => ...
}

Which we are not doing; we are using two separate "if" statements

My question is, for the following logic:

                for log in service_logs.extra {
                    self.process_logs(
                        &service,
                        &mut zip,
                        &mut log_snapshots,
                        log.path.as_path(),
                        LogType::Extra,
                    )
                    .await?;
                }

What about this is "NTP-specific"? This seems like a generic way to "grab all extra logs", and could be the default thing we do for services

Oh yea totally -- will get something pushed to make that generic with some extra comments.