This can be a sign of unauthorized access--possibly somebody even patching the kernel to mask their access. A simple program which regularly pings all other servers, and sends a page to administrators when the server is not responding is useful in this regard (see pingcheck).