Почему/var/log/auth.log.1 меньший, чем auth.log

Да и нет:

• Да, auth.log переименован к auth.log.1
• Нет, auth.log.1 не обязательно меньше, чем auth.log поскольку это зависит от использования машины.

НАПРИМЕР: На моей машине:

ll /var/log/auth*
-rw-r----- 1 syslog adm 209K Nov 30 17:55 /var/log/auth.log
-rw-r----- 1 syslog adm 304K Nov 25 17:08 /var/log/auth.log.1
-rw-r----- 1 syslog adm  27K Nov 18 09:20 /var/log/auth.log.2.gz
-rw-r----- 1 syslog adm  16K Nov 11 07:35 /var/log/auth.log.3.gz
-rw-r----- 1 syslog adm  19K Nov  5 07:35 /var/log/auth.log.4.gz

Однако другие (более старые) журналы сжаты так, они действительно меньше.

Вращение журнала организовано logrotate пакет, который был разработан для задачи. От man logrotate

NAME
       logrotate ‐ rotates, compresses, and mails system logs

SYNOPSIS
       logrotate [-dv] [-f|--force] [-s|--state file] config_file ..

DESCRIPTION
       logrotate  is  designed to ease administration of systems that generate large numbers of log files.  It allows automatic rotation, compression, removal, and mailing of
       log files.  Each log file may be handled daily, weekly, monthly, or when it grows too large.

       Normally, logrotate is run as a daily cron job.  It will not modify a log more than once in one day unless the criterion for that log is based on the  log's  size  and
       logrotate is being run more than once each day, or unless the -f or --force option is used.

       Any  number  of  config files may be given on the command line. Later config files may override the options given in earlier files, so the order in which the logrotate
       config files are listed is important.  Normally, a single config file which includes any other config files which are needed should be used.  See below for more infor‐
       mation on how to use the include directive to accomplish this.  If a directory is given on the command line, every file in that directory is used as a config file.

       If  no  command line arguments are given, logrotate will print version and copyright information, along with a short usage summary.  If any errors occur while rotating
       logs, logrotate will exit with non-zero status.