How do you detect log tampering in a compromised system

Question

After a security incident, I want to ensure logs haven’t been altered or erased by an attacker. My key concerns are:

• What are the signs of log tampering?
• How to use forensic techniques to detect changes.
• What tools (e.g., auditd, File Integrity Monitoring) help with log integrity.

Best practices for securing logs against manipulation would be useful.