An IoA that involves previously stored log files to be missing from the syslog file. Clear sign of tampering.