The hour missing from auth.log
auth.log on files-01 jumps from 01:58 to 03:10. The journal and the login records were not touched. Find the gap, the session inside it, and how lines were removed.
Briefing
During an unrelated review you notice that /var/log/auth.log on files-01 has no entries between roughly 02:00 and 03:00, a busy hour for backups.
journald keeps its own copy of sshd messages, and wtmp (read with last) records logins separately. A responder also collected root’s shell history into /cases/ir-2291.
files-01 · Linux log triage
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.