Thanks for looking in to it Peter. Sorry for the confusion, but I did not install syslog-ng. I left the machine with the default. Digging around, I now see that rsyslogd is the default. Syslog-ng is what poppped up in the package auto-complete when I typed "syslog" so I thought, incorrectly, that's what ubuntu was using.
I suspect the problem is some sort of installer bug or race condition here the auth.log file gets created with the wrong owner. Googling around, you can see forum threads where people have this symptom of auth.log staying empty now and then going back years. This bug can at least document how to check for the problem and fix it: /var/log/auth.log should be owned by "syslog" (not "messagebus"), so doing an ls -l should look like this ls -l /var/log/auth.log -rw-r----- 1 syslog adm 30310 Oct 2 12:17 /var/log/auth.log If it is not owned by syslog, fix it like this: sudo chown syslog /var/log/auth.log I'll see if I can figure out how to submit a test case for it. ** Package changed: syslog-ng (Ubuntu) => rsyslog (Ubuntu) -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1059854 Title: auth.log is empty To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/rsyslog/+bug/1059854/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
