Which script rotates /var/log/auth.log?
Solution 1:
At least on my Ubuntu 13.04 installation (physical machine, desktop edition), auth.log is rotated by logrotate as defined in /etc/logrotate.d/rsyslog. This is correctly found by grep auth /etc/logrotate.d/*. The rotated files get named as usual auth.log, auth.log.1, auth.log.2.gz and so forth. This is, as far as I can tell, the default way of handling the auth log. Maybe you're using a customized version of Ubuntu.