It is strange, but I was going through logs at /var/log/secure (CentOS 6.2). As such it is typical for break-in attempts to be logged. However, there is one such record:
Connection closed by 76.XX.XX.X
But no corresponding 'Failed' or 'Accepted' log records. Is this a case of successful break-in where the intruder erased the log records and only the post disconnect log remain? How do I go about analyzing the situation? I have configured iptables to allow only 2 attempts per minute for SSH. 'root' login is disabled.