I was reading the auth.log in winscp and there was an error and it got deleted somehow. I restored auth.log from the backup and set the correct owner and permissions, but no new data is being written to it. Got it--had to put the hyphen back at -/var/log/auth.log in rsyslog.conf (hyphen was automatically removed when there was no auth.log file to write to?) and restart rsyslogd (Debian server): /etc/init.d/rsyslog restart
