Today I found a lot of log files empty, these were:
/var/log/auth.log
/var/log/syslog
/var/log/daemon.log
/var/log/kern.log
/var/log/mail.log
/var/log/user.log
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/messages
First, it made me wonder if I had been hacked and someone had been deleting their traces. But looking around the web for clues and searching for suspicious activity, I didn't find any.
I decided to try and restart rsyslog. And what do you think? The logs are coming in again, actually showing me someone is trying to brute-force SSH users. So I turned off password login for sshd.
So, my question is: Does rsyslog sometimes hang, and stop logging?
Could this be a logrotate issue? The syslog.1 files and similar have log data.