Should we expect logs from a compromised system to be truthful?

No, of course not. Covering your tracks by manipulating logs and monitoring tools is stuff any sophisticated attacker would do

Perhaps if those logs were streamed to a non-compromised machine and stored there