Keeping logs is easy; proving them is hard
Under Turkish Law No. 5651, almost every organisation that gives internet access to staff or guests must keep traffic records for a set period. Most believe they comply by writing firewall logs to a disk. The problem surfaces the day a prosecutor asks for them.
The question is no longer “do you have the logs?” It is: how do you show they have not been altered since? A plain-text log file can be edited by anyone with access, and a record that hides its own modification is weak evidence.
Define your obligation first
Retention period and whether a timestamp is mandatory depend on the capacity in which you provide internet. Four profiles cover most cases: non-commercial mass-use providers (companies, malls, schools, hospitals), commercial mass-use providers (cafés, hotels), hosting providers and access/proxy providers — the last two with mandatory timestamps. Regulations change, so confirm your situation with legal counsel, then encode the decision once in the system.
Three layers of immutability
1. Hourly seal and hash chain
Logs are split into hourly segments. When an hour closes, its SHA-256 digest is chained to the previous hour's. Delete or change one line and that hour no longer matches, nor does any link after it.
2. Timestamp
The chain is anchored with an RFC 3161 timestamp. Note that a local timestamp server proves integrity but is not a qualified timestamp under Law No. 5070; profiles where timestamps are mandatory need a trust service provider.
3. Delete-proof archive (WORM)
Sealed segments go to object-locked storage that cannot be deleted before retention expires — not even by an administrator. Whether the lock actually works should be measured, not assumed; some storage services silently ignore lock requests.
“Who used that IP at that time?”
A firewall log gives an internal IP and a time, not a person. The answer requires joining NAT records, DHCP leases and Active Directory sessions or guest logins for the same moment — and that mapping must be captured when it happens, because leases rotate and sessions end.
Evidence package: verifiable on the expert's own computer
Delivered logs should come with a manifest, timestamps, a verification report and a handover record, and the recipient must be able to re-verify the chain without connecting to your system or the internet.
Marta Teknoloji's solution: LogHane
LogHane is Marta Teknoloji's cloud-based retention and evidence platform for FortiGate logs, compliant with Law 5651 and KVKK — no server to install or maintain. It collects logs over syslog or TLS, seals every hour into a chain, anchors the daily Merkle root with a timestamp and writes segments to object-locked archives, measuring the lock by reading it back. Its identity screen answers “who used that IP?” in one sentence, and evidence packages are produced as ZIP or CD-ready ISO with an offline verifier.
Run LogHane in our cloud or on your own server. Explore the sample demo or see the packages at loghane.com.