View Event Integrity Check Results

To view the status and results, select Admin > Event Integrity.

The Event Integrity Check feature provides the following status and results:

View the Event Integrity Check Status

The Event Integrity Check status displays the date range from which the results are currently being checked, as well as the current status.

If the system is busy, it might take a moment for the interface to indicate whether a check is running or has been canceled.
New

Indicates that you have never performed an Event Integrity Check; therefore, no results display.

In Progress

Indicates that an Event Integrity Check is running. If Run is disabled, a check is running currently. You can run one check at a time only.

Canceled

Indicates that you canceled an Event Integrity Check, and the system has completed the cancel task.

Canceling the check might take time to end the tasks that had been in progress.

Completed

Indicates that the Event Integrity Check has completed successfully. The results display in the results table.

Failed

Indicates that the Event Integrity Check failed to complete due to an error. The following table lists the failure categories and recommended remediation.

Hover your cursor over the information icon next to "Failed" to display the corresponding error message.
For this error... Which indicates that... You might want to...
No Data Found The check did not find verification events in the selected date range Enable Event Integrity in the SmartConnector or Transformation Hub

Insufficient Disk Space

 The system does not have enough disk space to run the check

Run the check when the system is less busy

Insufficient Resources

 The system does not have enough memory to run the check

Run the check when the system is less busy
Event Integrity Running An Event Integrity Check is already running Wait for the current check to finish or cancel the check in progress
Other errors Depends on the situation Review the details of the error in the Search Engine log

 

 

View Last Event Integrity Check Results Table

The Last Event Integrity Check Results table displays the date range from the last check as well as the details of the last check, including the following information:

The Event Integrity Check might display the last result from another user. The last result might also display after logging out.
Base events checked

Represents the number of base events referenced by verification events found in the specified date range.

Intact events

Represents the number of base events referenced by verification events that passed the Event Integrity check.

Missing events

Represents the number of base events referenced by verification events where missing base events exist.

You might see this result when the integrity check finds the verification events before ingesting their associated base events. Try adjusting the start or end date for the check.
Tampering has been detected

Represents the number of base events referenced by verification events where the Event Integrity check failed to match the information provided by the verification events, such as due to a change in the data in the base event.

Missing hashes, incorrect hashes, or base events being out of sequence usually indicates that the data has been deliberately changed in an attempt to hide a user’s activities.

Duplicate base event IDs

Represents the number of base events referenced by verification events where the Event Integrity check failed because more than one base event has the same globally unique event ID. This situation results in the Event Integrity check of the referenced base events to fail.

Duplicate verification events IDs

Represents the number of base events referenced by verification events where the Event Integrity check failed because more than one verification event has a globally unique event ID.