When empty user name is used for authentication then there is no audit log related to this event. It does not appear in syslog nor audit file. Empty username should be logged since it can be valid configuration for some systems.