might have been hacked?

[Kahn Seidl]

We are running a dns server running bind 8.  And also webmin.  There were 
login attempts that showed up on the screen, and I checked the IPS, and they 
are websites from germany.  What logs can I check to see if someone had 
successfuly logged in?  Or where are places that I can search?  Things that 
might be different?  It seems as if a couple of our dns entries were 
deleted, but, doesn't show  up in the log?  Any help is appreciated thanks

martin