Hacker News Reader

For years I've been considering coding a tamper proof logger, something where each entry has a hash that depends on the entry's log and the hash of the previous entry. This could help detect potential system compromise.

I haven't really taken the time to look for a logger with such a feature, it would be nice to know if fluentd has something like this.

View on HN

systemd's "journald" does this, it's called "Sealing", and it's enabled by default.

I turn it off on my stand-alone systems, it's a waste of processing on them IMHO (particularly if you don't backup the sealing key)

That's an interesting idea: right now, we do not have this. However, it should not be too difficult to implement it either as a filter or output plugin.

Reply on news.ycombinator.com