How to track deleted log files in a compromised Linux system

Question

After a suspected security incident, I discovered that certain log files were deleted. I want to determine if there’s a way to recover or track what was deleted. My concerns are:

• How to check for signs of log file deletion using system metadata (e.g., lsof, auditd logs)?
• How to recover deleted log files from disk (e.g., extundelete, foremost)?
• What are the best practices for securing logs against tampering, such as forwarding logs to a remote server?

Any insights into forensic techniques for detecting log tampering would be appreciated.