Could storage limits overwrite older logs?¶

Yes. Fixed-size files and circular buffers replace older entries as new events arrive. The earliest available record may mark storage rollover, not the beginning of system activity.

Event volume controls practical retention¶

Systems may rotate at a file size, retain a set number of files, compress archives or overwrite the oldest slot. High-volume failures, scans or service faults can consume capacity faster than usual, including during the incident itself.

Rollover may leave no blank interval: the surviving log simply starts later. File names, generation numbers and headers may show that earlier segments once existed.

Relate configuration to observed volume¶

Preserve active and rotated files promptly, including metadata. Record first and last entries, configured size, retained generations and archive destination. Estimate whether event volume could account for the lost period and check collectors, backups or SIEM copies.

Absence of old entries is not proof of deliberate deletion. The supported conclusion depends on whether rotation settings and record volume explain the boundary.