m1@m1-desktop:~$ cat /etc/logrotate.d/rsyslog
/var/log/syslog
{
rotate 7
daily
missingok
notifempty
delaycompress
compress
postrotate
invoke-rc.d rsyslog rotate > /dev/null
endscript
}
/var/log/mail.info
/var/log/mail.warn
/var/log/mail.err
/var/log/mail.log
/var/log/daemon.log
/var/log/kern.log
/var/log/auth.log
/var/log/user.log
/var/log/lpr.log
/var/log/cron.log
/var/log/debug
/var/log/messages
{
rotate 4
weekly
missingok
notifempty
compress
delaycompress
sharedscrip
Great, do you do have syslogs dating back a week to inspect. Namely these:
-rw-r----- 1 syslog adm 221063 May 4 11:03 syslog
-rw-r----- 1 syslog adm 480516 May 4 07:43 syslog.1
-rw-r----- 1 syslog adm 71338 May 3 10:28 syslog.2.gz
-rw-r----- 1 syslog adm 101993 May 2 08:56 syslog.3.gz
-rw-r----- 1 syslog adm 70681 May 1 07:35 syslog.4.gz
-rw-r----- 1 syslog adm 37431 Apr 30 19:00 syslog.5.gz
-rw-r----- 1 syslog adm 8234 Apr 29 07:35 syslog.6.gz
-rw-r----- 1 syslog adm 8185 Apr 28 07:35 syslog.7.gz
You should be able to go back through them and align your "freezes" with what is in them for those times.