Rotate and manage logs

Rotate the auth and syslog files today: archive /var/log/auth.log and /var/log/syslog older than 7 days, compress them, update the rotation symlink, and restart the logrotate service; verify post-rotation that file descriptors were released and file sizes are back to normal.

Before rolling a new rotation policy, make it easy for ops to approve: show current disk usage caused by old logs, surface which services hold open descriptors preventing rotation, highlight retention costs for long-term storage, and flag any logs that contain PII which require special handling.

I triggered logrotate and compressed old logs, but df still shows disk usage high and lsof reveals deleted log files still held by rsyslog. I don't know whether to restart rsyslog now or to force a reopen from the service. What is the recommended immediate action that minimizes service disruption and ensures the space is reclaimed safely?

We keep hitting full disks on our log partitions because rotations get applied unevenly and some hosts never upload archives to long-term storage. Which habit change will most sustainably fix this: enforcing a central rotation policy with automated enforcement, scheduling a weekly audit to catch failures, or charging an owner per host? Recommend one change and a first enforcement step I can take this week.