What are common signs that a system has been compromised or hacked?

Increased amount of failed logon events

Patterns in time gaps in system and/or event logs

New user accounts created

Consistency in usage baselines

Partitions are encrypted

Server hard drives become fragmented