Up until few days ago I was using Ubuntu 10.04 (where all worked like a clock).

Just switched to Ubuntu 12.10 and what annoys me the most is that some logs are switched off by default. For example, I had to manually enable the mail.info log.

Still haven't found why the log /var/log/auth.log is emtpty. I use Putty terminal for ssh (using other than port 22), so I'd assume that my activity should be in the auth.log.

I tried editing /etc/rsyslog.d/50-default.conf (and restarting), but no change.

Had the same problem on my Ubuntu 12.10 instance. Some of the system log files, including /var/log/auth.log, were owned by `messagebus`.

chown syslog /var/log/auth.log should resolve this issue.