Just took a look at my server auth.log file for the first time in a few days, and noticed that it has no entries before 6:47 this morning.
This is really odd because I dumped that logfile to my laptop when I looked at it a couple of days before, and it was well over 2400 lines of cron jobs, break-in attempts etc.
When I ran
cat /var/log/auth.log just now - I was expecting thousands of lines, and got about 50 lines of cron jobs, one break-in attempt and my latest ssh in.
Why has this happened? - Does Ubuntu periodically empty this file? Have I been hacked?