Checking the Integrity Of Event and Flow Logs
When log hashing is enabled, any system that writes event and flow data creates hash files. Use these hash files to verify that the event and flow logs were not modified since they were originally written to disk.
The hash files are generated in memory before the files are written to disk, so the event and flow logs cannot be tampered with before the hash files are generated.
Ensure that log hashing is enabled for your JSA system. For more information about enabling log hashing, see Enabling Log Hashing.
You must log in to the system that has the data storage for events and flows, and run a utility to check the logs. You cannot check the log integrity in the event and flow viewer interface.
If an ERROR or FAILED message is returned, the hash
key that is generated from the current data on the disk does not match the hash key
that was created when the data was written to the disk. Either the key or the data
was modified.
Enabling Log Hashing
Enable log hashing to have any system that writes event and flow data creates hash files. Use these hash files to verify that the event and flow logs were not modified since they were originally written to disk. The hash files are generated in memory before the files are written to disk, so the event and flow logs cannot be tampered with before the hash files are generated.
The system uses the following hashing algorithm types:
Message-Digest Hash Algorithm
Transforms digital signatures into shorter values called Message-Digests (MD).
Secure Hash Algorithm (SHA) Hash Algorithm
Standard algorithm that creates a larger (60 bit) MD.