Endpoint Protection Wiped Logs on Windows Servers

Update: I checked the logs this morning, and all servers had log entries for last night's anti-virus checks only. Except for those single entries, the logs were empty.

Based on that, I assume that a bug in a recent Sophos Endpoint Protection update actually wiped the logs between Sunday 30 July 2017 and Monday 31 July 2017. The logs are now repopulating with new entries again. I will continue to check for the next few days to make sure that all anti-virus checks are being logged. 

Am I the only one who runs nightly anti-virus checks on critical servers?

By the way, we have paid Premium Support from Sophos. We rarely use it (perhaps once or twice a year at most). I called Sophos when I thought the problem might be a hacker trying to cover his/her tracks. The support person promised to follow up and have a US-based technical support person with detailed product knowledge call me this morning at 7:30 AM PDT to follow up. It is now 8:20 AM PDT. Sophos has not called yet. I am sorry to say that I am not surprised that they did not keep their promise.

-> I would appreciate confirmation from someone who also saw the same log-wiping event. Anyone? Please?

Further Update and Solution/Explanation:

I just spoke with Sergio, who is on the Anti-virus team at Sophos. Based on what we learned together, this is not a bug. We looked in a few Sophos log directories, and figured out that logs automatically roll over at the end of the month, so the timing was coincidental. The logs were not wiped, and I can see the previous logs in the appropriate directories under C:\ProgramData\Sophos\

My endpoint protection logs rolled over in the directory: C:\ProgramData\Sophos\Sophos Anti-Virus\Logs

I check the logs once a week, so it is random luck that I never noticed a rollover before. That's because the window displays logs only for the previous two days or so due to the size of the window on the screen. The log entries always show that no malware was detected (0 errors, 0 items quarantined, and 0 items dealt with). Why bother to scroll up the window to look for more of the same?

I don't know whether to call it good luck or bad luck. :-)

Further Update and Solution/Explanation:

I just spoke with Sergio, who is on the Anti-virus team at Sophos. Based on what we learned together, this is not a bug. We looked in a few Sophos log directories, and figured out that logs automatically roll over at the end of the month, so the timing was coincidental. The logs were not wiped, and I can see the previous logs in the appropriate directories under C:\ProgramData\Sophos\

My endpoint protection logs rolled over in the directory: C:\ProgramData\Sophos\Sophos Anti-Virus\Logs

I check the logs once a week, so it is random luck that I never noticed a rollover before. That's because the window displays logs only for the previous two days or so due to the size of the window on the screen. The log entries always show that no malware was detected (0 errors, 0 items quarantined, and 0 items dealt with). Why bother to scroll up the window to look for more of the same?

I don't know whether to call it good luck or bad luck. :-)