Abstract: One or more access events can be logged to a system log. The system log includes a history of recorded user device actions. A request associated with modifying the system log can be received. The modifying of the system log may be denied based at least in part on a plurality of distributed nodes invalidating the request. Each of the plurality of distributed nodes may include a copy of the system log. The invalidating of the request may include comparing contents of the copy of the system log with the request.