View Event Integrity Check Results

Select Configuration > Event Integrity.

The Event Integrity Check feature provides the following status and results:

View the Event Integrity Check Status
View Last Event Integrity Check Results Table

View the Event Integrity Check Status

The Event Integrity Check status displays the date range from which the results are currently being checked, as well as the current status.

If the system is busy, it might take a moment for the interface to indicate whether a check is running or has been canceled.

New

Indicates that you have never performed an Event Integrity Check; therefore, no results display.

In Progress

Indicates that an Event Integrity Check is running. If Run is disabled, a check is running currently. You can run one check at a time only.

Canceled

Indicates that you canceled an Event Integrity Check, and the system has completed the cancel task.

Canceling the check might take time to end the tasks that had been in progress.

Completed

Indicates that the Event Integrity Check has completed successfully. The results display in the results table.

Failed

Indicates that the Event Integrity Check failed to complete due to an error. The following table lists the failure categories and recommended remediation.

Hover your cursor over the information icon next to "Failed" to display the corresponding error message.

For this error or warning...	Which indicates that...	You might want to...
Insufficient Disk Space...	The system does not have enough disk space either to run the check or to create a table in the database for the verification events	Run the check when the system is less busy
Insufficient Resources...	The system does not have enough memory either to run the check or to create a table in the database for the verification events	Run the check when the system is less busy
Event Integrity Running	An Event Integrity Check is already running	Wait for the current check to finish or cancel the check in progress
No events found in the specified time range	Either the events do not exist or the system cannot communicate with the data source	Check whether the SmartConnector, Transformation Hub, or Kafka Scheduler is offline
No verification events found in the specified time range	The system might not be configured correctly	Check whether SmartConnectors or Transformation Hub have been configured to support Event Integrity Checks
More than one algorithm found	The system might not be configured correctly	Ensure that only one algorithm has been specified for Event Integrity Checks in the SmartConnector and Transformation Hub
Unsupported algorithm (SHA512) found	The system is not configured correctly	Ensure that the SmartConnector or Transformation Hub have been configured to use one of the approved algorithms: MD5, SHA-1, or SHA-256
Other errors	Depends on the situation	Review the details of the error in the Search Engine log

View Last Event Integrity Check Results Table

The Last Event Integrity Check Results table displays the date range from the last check as well as the details of the last check, including the following information:

The Event Integrity Check might display the last result from another user. The last result might also display after logging out.

Base events checked

Represents the number of base events referenced by verification events found in the specified date range.

Intact events

Represents the number of base events referenced by verification events that passed the Event Integrity check.

Missing events

Represents the number of base events referenced by verification events where missing base events exist.

You might see this result when the integrity check finds the verification events before ingesting their associated base events. Try adjusting the start or end date for the check.

Tampering has been detected

Represents the number of base events referenced by verification events where the Event Integrity check failed to match the information provided by the verification events, such as due to a change in the data in the base event.

Missing hashes, incorrect hashes, or base events being out of sequence usually indicates that the data has been deliberately changed in an attempt to hide a user’s activities.

Duplicate base event IDs

Represents the number of base events referenced by verification events where the Event Integrity check failed because more than one base event has the same globally unique event ID. This situation results in the Event Integrity check of the referenced base events to fail.

Duplicate verification events IDs

Represents the number of base events referenced by verification events where the Event Integrity check failed because more than one verification event has a globally unique event ID.