To further protect your data, GFI EventsManager provides you with record hashing capabilities. Hashing new records is a method used to ensure that data in your databases remains unmodified. When record hashing is enabled, a hash is created for every collected log, at collection time. The hash is built based on the data contained in the event log itself and created as soon as the event log is collected to ensure that it is the original version. When data of a hashed record is modified (even a character from a word), the hash value changes, indicating that someone could be tampering with stored records.

Important

Hashing will fail if anonymization is enabled.

To configure hashing:

Enabling / disabling record hashing

1. From Configuration tab > Options > Configurations, click File Storage > Configure hashing....

Record hashing dialog

2. Select/unselect Enable record hashing to turn on/off hashing features.

3. Click Check records hashes to run hash checks on the selected database. Select a database from the list and click OK to start the check.

4. Click Apply and OK.