'Detected Tampering with Log File' Alert Repeatedly Appearing in EthoVision XT System Log
Last updated: Nov 01, 2026
Problem
EthoVision XT repeatedly displays or logs a 'detected tampering with log file' alert. The issue is not caused by normal experimental operations and recurs even after previously being managed by controlling how Excel files are modified and saved.
Details
The tampering detection alert indicates that EthoVision's internal log or data integrity check has detected an unexpected modification to one of its log files. A previous instance was traced to Excel file format modifications and saves, suggesting that external processes writing to or modifying files in the EthoVision experiment directory trigger the alert. The root cause of the 2025 recurrence is under investigation. Affects EthoVision XT; specific version not stated.
Solution
1. Identify which log file is triggering the alert: check the EthoVision system log or error details for the specific file path mentioned in the tampering alert.
2. Ensure that no external application (e.g., Excel, antivirus, backup software, or Active Directory sync tools) is reading from or writing to files within the EthoVision experiment folder during acquisition or analysis.
3. If Excel is involved: avoid opening EthoVision-generated export files directly from the experiment folder with Excel while EthoVision is running. Copy the export files to a separate location before opening them in Excel.
4. Review whether any scheduled tasks, antivirus scans, or backup processes are accessing the EthoVision experiment directory and, if so, exclude the experiment folder from those processes.
5. Check whether any recent Windows Update or software change introduced a new background process that accesses the log file.
6. If the alert appears but does not affect data integrity or software function, document the occurrence and report it to Noldus support with the full system log and a PC report so the root cause can be investigated for a permanent fix.
7. As a workaround, store experiment files on a local drive that is not subject to network sync or active IT monitoring during acquisition.