handle embargo_dt in hydra permission query
let logrotate handle log rotation and retention