[dentin]

Darren,

There is no certainty that something hasn't been faked, merely evidence. In rough order:

1) If the log contains obvious typos and inconsistencies that the game is incapable of producing, then it's probably been edited. I have received numerous logs that had inconsistencies, and for every one editing was confirmed on asking.

2) If a log conflicts with other logs, indicating events that did not happen or removing events that did happen, then it has probably been edited. Several times I've cross-correlated player logs with system logs and other information, noticed inconsistencies, and had the player verify that the logs had been edited prior to submission.

3) I've never had a player, who when faced with a logfile, said "that didn't happen, the log is wrong". If the defending player basically admits that the log is correct, then the log is probably correct.

Again, it comes down to evidence, and making the best decision available to you with the information provided. It's an awful lot like the adversarial court system - if adversarial parties agree on a fact, then it can probably be considered a fact in that instance. If there's disagreement, as admin you have to weigh all the evidence available to you to make a proper determination. You're never going to get certainty.

In my opinion, this quest for 'verifiable integrity of logs collected and submitted by players' is a red herring, and your time would be vastly better spent improving the logging facilities of the server:

- Questionable game related features that are a potential problem should be logged
- Illegal actions that are theoretically impossible should be logged, because they can probably happen
- Actions that have a large impact on any single player should be logged (death, large amounts of gold/equipment moving, password changes, summoning, pet killing, etc)
- Actions that have a small impact on many players should be logged (channel spamming, auction spamming, group spamming, group death marches.)
- The top ~1% of players that have a history of being social whores/drama queens should be player logged, as they are stupidity attractors
- The top ~1% of players that have a history of being assholes or jerks should be player logged, as they are stupidity producers
- Anyone who has a history of being near the center of more than a small number of events should be player logged, because it's likely they'll be near yet another event in the future. Bystander logs have been a critical factor in several cases

AA generates about 6000 lines in its system logfile daily, at an average of about 50 players logged in and busy. Between the system logs and system generated player logs, it's enough to deal with nearly all of the questionable game related activity that surfaces, and I only have to fall back to more messy methods for the small remainder. It is exceptionally rare that I request a player log for any reason other than server debugging.

-dentin

Alter Aeon MUD