A half-hour health check at the end of the year

Half an hour once a year, per machine:

• Disk: df -h, df -i, smartctl -H — thresholds and reallocated sectors.
• Certificates: days remaining, via certbot certificates or openssl s_client.
• Backups: when was the last restore drill, and does the archive actually open.
• Accounts: awk -F: '$3>=1000' /etc/passwd, plus any unfamiliar keys in authorized_keys.
• Services: systemctl --failed — anything failing quietly.
• Logs: journalctl --disk-usage, and whether rotation still works.
• Packages: apt list --upgradable — security updates piling up.

Script it and run it next year. Write the findings down; memory is not a ticket system.