did you get hacked? check.

$ grep “Accepted password” /var/log/messages

That’s a really bad check unless you have an external box receiving logs and you’re looking there, because the first thing that a sophisticated attacker is going to do if they get in as root is remove the signs of their presence.