A log rotation policy is correct while a filebeat or rsyslog harvester keeps the deleted descriptor open and disk usage never falls during a staged decommission

The rotated files are gone from the directory and still present on disk. The service still works through the primary path, but one dependency only fails when the old component is finally drained away.