--- title: "Verifying audit logs" slug: "dpo-configure-verifying-audit-logs" updated: 2026-10-27T20:13:12Z published: 2026-10-27T20:13:12Z canonical: "docs.onespan.com/dpo-configure-verifying-audit-logs" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.onespan.com/llms.txt > Use this file to discover all available pages before exploring further. # Verifying audit logs DigipassONE audit logs are tamper-evident logs. When you run a checksum on the logs with the nnl-mgmt.sh command-line utility, you can be sure that no one has tampered with the logs after they were created. If the checksum fails, the verifier displays the tampered log. Each line in an audit log is written out with a checksum which allows you to start verification from any line. The nnl-mgmt.sh audit_log verify command does not work on the Runtime Audit Log in CSV. For a complete description of the verifier, see [Audit Log Verification Command](/dpoa/docs/s3suite94-audit-log-verification-command-1) in the reference to *Command Line Interface.* The location of audit logs is listed below: - Runtime audit log in JSON: TOMCAT_HOME/logs/auditlogs/ - Server Admin Console audit log: TOMCAT_HOME/logs/admin-auditlogs/ - Command-line tool audit log: /admin/logs/admin-auditlogs. > Make sure you assign the password encryption key to the NNL_PKEY environment variable prior to using nnl-mgmt.sh. Refer to [Step 4 Encrypt Credentials Used by the Server](/dpoa/docs/s3suite94-step-4-encrypt-credentials-used-by-the-server-1) in *Install on Linux*. Example successful verification: ```plaintext ./nnl-mgmt.sh audit_log verify -file TOMCAT_HOME/logs/auditlogs/Admin/nnl-audit-Admin-myhostname.log Date/Time ==> Tue Sep 26 20:27:49 UTC 2017 Processing file ==> TOMCAT_HOME/logs/auditlogs/Admin/nnl-audit-Admin-myhostname.log For tenant ==> Admin Checksum Verification succeeded for file : TOMCAT_HOME/logs/auditlogs/Admin/nnl-audit-Admin-myhostname.log 1 : Checksum Verification succeeded for file : TOMCAT_HOME/logs/auditlogs/Admin/nnl-audit-Admin-myhostname.log ``` Formerly known as Digipass S3.