Why has my auth.log file emptied - is this normal?

Solution 1:

There is a cronjob in /etc/cron.daily (in CentOS anyway, may be different in Ubuntu) to run a tool called logrotate, which reads configuration from /etc/logrotate.d and handles the aging of system logs, etc.

Typically, a weeks worth of logs are kept, rotated once daily. In modern implementations, you will see other files named /var/log/auth.log.[date]. Try doing:

ls -l /var/log/auth.log*

Solution 2:

There's log rotation, which happens typically in the morning (I believe the default is at or shortly after 06:25). It looks like you pulled the file shortly after logrotate ran.

Depending on the logrotate configuration, the previous day's file will be named /var/log/auth.log.1. Look for it there.

The logrotate configuration is in /etc/logrotate.d. The cron job for logrotate is in /etc/cron.daily, with scripts in that directory being run from /etc/crontab.