Unknown Binary Blob in /var/log/syslog

Question

Our one of the production ubuntu14.04 system become unreachable in AWS, we restarted it via AWS console. After restarting the system, we were able to connect to it. We checked the /var/log/syslog and found following ^@^@ in the log

^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@Nov  4 04:48:49 ubuntu1404-production: [origin software="rsyslogd" swVersion="7.4.4" x-pid="887" x-info="http://www.rsyslog.com"] start
Nov  4 04:48:49 ubuntu1404-production rsyslogd-2307: warning: ~ action is deprecated, consider using the 'stop' statement instead [try http://www.rsyslog.com/e/2307 ]
Nov  4 04:48:49 ubuntu1404-production rsyslogd: rsyslogd's groupid changed to 104

What does it indicate ?

Answer 1

These characters are nul characters (zeros) that you might typically get if you seek beyond the end of file and start writing. Perhaps your restart stopped data being written to the file, but managed to update the meta data i.e. the size of the file.

So when rsyslog opens the file in append mode, it starts writing to the end of the file as given by the size, and the missing data gap is filled by nuls.