implementing-log-integrity-with-blockchain

Hash chaining computes SHA-256 over the previous entry's hash, timestamp, and content for each log entry, so modifying any entry invalidates its hash and all subsequent ones. Verification recomputes every hash from index 0 and reports the first broken index.

Run the agent script with the --verify flag against the chain file, for example: python scripts/agent.py --log-file /var/log/syslog --chain-file log_chain.json --verify --output integrity_report.json. The report pinpoints the first entry where the recomputed hash diverges.

Without external anchoring, an attacker who rewrites the entire chain including the genesis entry produces a valid-looking ledger. Anchoring checkpoints to an RFC 3161 TSA or OpenTimestamps makes a full rewrite detectable against an independent witness.

The ingestion step accepts syslog, JSON, and plain text log files. Each entry is stored in a JSON ledger with its index, timestamp, content hash, previous hash, and chain hash.

Each chain hash depends on the previous entry's hash, so a single modified entry breaks the chain at that point and invalidates every entry after it. Verification flags the first broken index and all subsequent entries as invalid by design.

Hash chaining only works if the ledger is stored on append-only or off-host storage such as WORM or S3 Object Lock; a writable ledger next to the logs allows tamper-then-rechain attacks. The hashed material must also include the index and timestamp to prevent reordering or replay.