I am looking for the best way to keep an auditor happy that no one has tampered with system event logs, either windows or linux, so if someone went in and changed or deleted the events from an index then we can tell. From my first read it sounds like IT hashes might be the best way. Does anyone have any suggestions or experience.
The answer should be that if you're able to show the auditor some type of hashing that logs changes to files which you're interested in seeing, the requirement is satisfied. That is the approach I have always seen in the past. If an auditor feels that a particular type of auditing is insufficient, they should be able to articulate to you what they'd find to be sufficient, and why the method you're using is faulty. Having worked on different types of compliance standards in the past, in my experience this can vary greatly from organization to organization, or even from different auditors within the same organization.