I was tried to change auth.log in /var/log/ and after that all of my login did not log. I dont know what is wrong. I tried to restart and it work again. After that, I changed it and it stop working. So I think some of service was stop. Anybody can tell me what service name. I dont want to reboot

This log file is opened by log application for writing. When you "change" this file, you actually delete it and create new file, but the log application still use a handle to the old file, which is now "hidden" in filesystem and will be deleted when log application close handle, at the end of working, example at system rebooting. To make a change you would first stop logging program (to close handles) and then delete or change log file, and restart log application. The log program depends on distribution you are using, search for "syslog" in name.

Anyway, log files is not intendent to be changed by hand, so please specify what you want to achieve, maybe you get better solution.

This is true
Why are you messing with it?

thanks for your help. I can do this now.
I want to test cracking tool so I remove the log file and tail it when I use hydra or ncrack to cracking password.