Troubleshooting auth.log empty
/var/log/auth.log can be empty due to various reasons but you can restore rsyslogd with its initial settings so that you get logs
Here is How you reinstall it:
# sudo apt-get remove rsyslog
# sudo apt-get install rsyslog
This will reinstall your rsyslog and you can get the auth logs
auth.log can also be empty when log is rotated. No action is needed in this case.