I have my pi opened to the internet for ssh access and to be more secure, I turned off password authentication and only allowed for key-based SSH. I logged into my pi earlier to check some things and I checked the /var/log/auth.log to look at the activity, but everything before today was flushed or deleted. Is this something that happens as a result of some process, maybe an update? Or is it possible that someone ssh'd into my pi and cleared the logs to cover their tracks? I've only had it open to the internet for maybe 2 weeks and I use RSA keys to log in to it, so it seems unlikely that it'd be broken so quickly. Just want to be sure I don't have to go into damage control mode.
This is a general Linux question; not Pi specific and should be asked on https://unix.stackexchange.com/ BUT is simple to answer.
Linux rotates logs on a regular basis.
You should find
auth.log.1 and earlier logs in
It is possible to configure the rollover, but most have 6 or 12 compressed logs on a weekly or monthly basis.