Missing entries from messages file

Question

I have a CentOS server that has been working well until recently. The virtualized instance of the server encountered some type of issue earlier today and required it to be hard rebooted in order for it to be able to be interacted with again. As I was digging through some of the log files to figure out what had happened, it appears that there are a number of days worth of entries that are missing from some of the log files. For example, the messages file has information from 6 days ago and then this morning after the reboot. I have looked through the tar g-zipped log rotated files as well and could not locate the needed information there.

• I was curious if there was a different place I could look for the information?
• What are some instances in which the information would disappear like this?
• Should I be worried about the machine having been compromised? A rkhunter scan did not find anything.

Answer 1

If you had no logs at all in a certain time period, then possibly your root partition was full at the time. Unless you've kept historical data about your filesystems, it can be next to impossible to make sure that was the problem if whoever deleted some large files didn't realize he was doing it.

Protecting against overflowing logs is difficult. Having a large partition for logs and doing remote logging help. You may also want to run some monitoring software that warns you when filesystems are getting nearly full.