Siraoops,LLC
LiLHash File Integrity Support
Once you receive your trial or paid key, copy the key to C:\ProgramData\LiLHash. This will unlock the LiLhash Analysis Console.
You may encounter Issues setting up the database if your database server is not setup correctly. This could cause the LiLHash File Integrity Monitor to become unresponsive. Review the Quick Start directions to make sure that you have not missed any steps.
If you cannot create file paths with LiLHash, the most likely cause if that you are not using a designated service account with the appropriate permission to access the file resources that you need. Assign a designated sql service account to your sql server instance with the appropriate permissions. This is easily remedied with an active directory service account.
You requested a key to use the LiLHash File Integrity Monitor and did not receive it. Check in your Junk E-mail, the trial key could be there. Also check with the IT Staff to see if the key request was blocked by an e-mail filter. The key request file is send out as a .TXT file. If you cannot get a key file through your company's e-mail system, you may choose an alternate e-mail address so you can receive your trial key. If you are having issues obtaining a trial key send an e-mail to Siraoops@outlook.com and let us know so we can assist you.
Antivirus software or Windows Defender may block the running of this software. Add the appropriate exception to allow this software to be executed.
Make sure resolution is greater than 1366x768 or display may not appear correctly.
Do not magnify text or display may not appear properly.
Backup will fail if the Sql Server Service does not have folder privileges to the backup folder that you select. To resolve the issue make the SQL Server Service use the account with the appropriate privilege to start the service.
Make sure that the account you used to login to the computer to run the LiLHash Console has the appropriate security permissions to access each servers windows system32 folder.
If you run the main LiLHash application and there is no data on any of the displays this could mean that the LiLHash.cfg is missing or does not contain the correct data. The LiLHash.cfg files should be in the directory with the rest of the LiLHash files. The file should contain two lines. The first line must be the name of the server hosting the database. The second line is the name of the database LiLHash. This situation could occur if you wish to run the LiLHash application on a different computer than where the console runs.
If you have specified a relay server and you are not receiving an e-mail alerts or texts, make sure you are allowing the server that runs the LiLHash and the LiLHash Console the ability to relay off of your mail server.
If you stop the Analysis on the LiLHash Control Console, the program will not stop immediately. It will have to finish its current process before bringing the program to a halt.
Columns in the list display can be used to sort the data provided that the entire column has no empty entries. If there are empty entrees in that column of data displayed do not sort by that column.
To facilitate fast data entry, data entry screens will be cleared after being saved and you can key in the next item without acknowledging unnecessary prompts. Your data you entered has been saved.
If training video will not play you may need a video player. If you are using Windows 10 you can download the Movie and TV app from the Microsoft Store for free!
Duplicate reports may take a long time to be created. The number of files in the data share will be a factor in how long it takes for the report to run. How you pare down the report with the filters may dramatically reduce the amount of time to create the report. For example creating an unpared down duplicates report of 250,000 files takes about 50 minutes. A report using the various filters can only take minutes to complete. It is best to create duplicate reports with an objective in mind.
If no report logs for a server are not being created, check the log path for the server. Select Edit Servers option to correct the log path for the server having the report issue.
If you specify alerts for a server but you do not setup the alert path, no Alerts will be saved for ANY server. Make sure you setup the path to store your Alerts.
If you have specified that you do not want alerts for a server, it will still show up in the LiLHash Console Display as an alert should there be any missing or modified files. However no alert log will be created for the server. If you have specified that you want alerts for the server an alert log will be created for the server provided that you have entered in an alert log path in the system setup.
When a Server is off-line and LilHash attempts to scan it, all files will be declared missing. If the server is going to be down during the designated scanning time , turn off scanning for this server so the server will not be scanned. This will prevent you from receiving an invalid report. Edit the Server and select N for Analyze. The server will be passed over.
If you are adding a share and the circle spins for a long time and nothing happens. Afterwards you will get a message that The Share Path Could Not Be Found. This occurs because the firewall is blocking access to the share. Enable the firewall rule Enable File and Printer Sharing (SMB-In) on Windows 2016 Server. You can limit the scope of this rule by clicking on the Scope tab. Then select These IP Addresses and add the address of every computer you run the LiLHash software on.
If Baseline operation was skipped or not successful, the previous Baseline will be used for the analysis.
If you enter in a server path in the Add a Server Path data entry screen and and you are told the path is invalid when it is a valid path, try an alternate way to enter in the path using an administrative share instead.
The File locator total file size for all the files located in the search may not be correct. This is due to the fact that the file sizes are taken out of the database and are accurate as of the last baseline performed.
Viewing Baseline and Scan reports through the report viewer may be slow. Some of these reports may be quite large and will take time to load. You may see a Not Responding message in the upper left. This is normal and can be ignored. You can wait for the report to display or you can abort the LiLHash adminstrative program and review the report with the windows notepad.
Virtual Machine issues...
If you select Analyze Servers from the Main Menu and the LiLHash Control App and the LiLHash Console do not start, you can run this programs directly by double clicking on LiLHashControl.exe and LiLHashConsole.exe respectively.
If the LiLHash Control App does not display properly after being minimized just refresh display by minimizing program to the taskbar and reselecting program from the task bar. You can also restart the program.
Scanning, Baselining or Alert Issues...
A Scan will be skipped if there is no baseline.
A Scan or Baseline can be skipped if the LiLHash Console is busy performing an operation. Make sure you have a large enough time Window for LiLHash to get to your specified operation.
A Scan will be skipped if you change the filemask of a custom file type. By changing the file mask for a share you will invalidate the current baseline. A new baseline will need to be created for the share before the next scan can be done. The old baseline for the share will be removed automatically and a new baseline will be trigged to occur on the current schedule. If this share is actively being scanned when the filemask is changed you will see a message in the message area saying that the scan was aborted.
If you change the Recurse option specified for a path, that will invalidate the baseline for that share. A new baseline will need to be created for the share before the next scan can be done. The old baseline will be removed automatically for the share and a new baseline will be trigged to occur on the current schedule. If the share is actively being scanned when the recurse option is changed you will see a message in the message area saying that the scan was aborted.
If a share is deleted at the time that share is actively being scanned, the scan will be aborted and processing will continue for the next share of that server or move on to the next server. You will see a message in the message area saying that the share was deleted.
Do not modify a share's filemask or recurse options while the baseline is actively being created for the share. If you have performed this action cancel the baseline for the share to allow the new options you have selected to go into effect on the next pass for that share. If you didn't cancel the baseline before it completed, edit the share and change the baseline option to Y. This will create a new baseline for the share on the next pass.
If both a baseline and scan are scheduled to occur, only one operation is performed per pass working with the server share. The operation that will be done is the baseline. The scan will be done in the following pass for the server share. Baseline operations are given priority.
Make sure the account running the LiLHash Console has sufficient privileges on the servers you wish to baseline and scan.
If you stop a scanning operation, the share stats for the scan that was stopped will not be updated.
If you are baselining a directory that contains one or more files that are always changing, these may be good files for exemption status. By exempting certain files this will eliminate false alarms. Examine your alarms and determine if adding exemptions will help. Partial and exact matches can be used for exemptions. Becareful with partial matches as you may exempt more files than desired.
If the built-in file masks do not include the files you need to scan, create a custom file mask that will meet all your needs. If you are scanning files that should never be changed use the Custom - Hash and Deletes, if you are scanning data files that can be changed but not deleted use the Custom - Deletes Only file mask option.
On the LiLHash Console you may notice that the server progress bar remains all the way to the right sometimes. This occurs if the server has only one share. This is normal. The server progress bar will be more accurate when a server has more than one share.
If the LiLHash Console will not start, make sure the LiLHash Control app's Analyze is set to Y. Then Click on the Analyze button on the LiLHash Console.
If you click on the LiLHash Console on the taskbar and it will not maximize, check the LiLHash Control app and make sure Maximize is set to Y. If Maximize is set to Y already and you are in the middle of a baseline operation, you will have to wait for this to complete before the LiLHash Console will be maximized.
In the LiLHash Console the Current Server Progress bar typically stays all the way to the right when the server has just one share. This is normal. This progress will be more informative when the server has more than one share.
In the LiLHash Console the Quantity Found counter is updated with every 1000 files encountered for shares with less or equal than 10,000 files. For shares with 10,001-50,000 files the Quantity Found counter is updated with every 2,000 files encountered. For shares with 50,001-100,000 files the Quantity Found counter is updated with every 3,000 files encountered. For shares with 100,001-200,000 files the Quantity Found counter is updated with every 4,000 files encountered. For shares with 200,001-300,000 files the Quantity Found counter is updated with every 5,000 files encountered. For shares with more than 300,000 files the Quantity Found counter is updated with every 10,000 files encountered. This Quantity Found update frequency is by design to prevent slowing down the Scanning process unnecessarily while still providing real-time status of the scan.
If a share is deleted, LiLHash will cancel the scanning operation as soon as possible if it is actively scanning that share. If the baseline is invalidated due to a filemask change or a recurse option change when editing an actively scanned server share, the scan will be terminated as soon as possible.
If the control panel app appears unresponsive after you make a selection, keep in mind that your selections will not be processed immediately. The LiLHash Console will perform your requests as soon as it can. The larger the scan being scanned, the longer it will take the LiLHash Console to respond. This is intentional not to slow down the scanning speed of the LiLHash Console.
During a baseline operation the LiLHash Console may state Not Responding. This is normal and should be allowed to continue. If you click on the LiLHash Console at this time it may turn white. You must wait for the operation to complete for the Not Responding message to disappear and the display to return to normal.
After a baseline operation gets beyond a certain point in its processing you will not be able to abort the operation. If the LiLHash Console states Not Responding you will need to wait for the operation to complete. If you click on a Not Respondng LiLHash Console it will turn white. Allow it to complete and the display will return to normal. If it is an emergency and you need to stop the baseline processing immediately, you can end the LiLHash Console task in the Windows Task Manager.
Very large shares that are being prepared for scanning may cause the LiLHash Console to state not responding briefly. This is normal and can be ignored.
Deleting a Server from the LiLHash File Integrity Monitor does not delete the server. It just removes the server from automated Baseline and Scanning operations.
Deleting a Share/Path from the LilHash File Integrity Monitor does not delete the Share/Path. It just removes the Share/Path from automated Baseline and Scanning operations.
View Baseline and Scan Summaries and Reports will not sort on the numeric columns. This is a known issue.
View Alert Summaries and Reports will not sort on numeric columns. This is a known issue.
View Alert Summaries and Reports will load a report slowly if it contains thousands of entries. You can wait patiently or you can go to the actual location of report and view it there with the notepad.
View Baseline and Scan Summaries and Reports will load a report slowly if it contains thousands of entries. You can wait patiently or you can go to the actual location of report and view it there with the notepad.
If you rename the computer that is running LiLHash the Analysis Console, the analysis console no longer works. To resolve this issue rename the portion of the .key file containing the old computer name with the new computer name.
If you don't get e-mail alerts for a server, make sure that you assign that server to your contacts.
You may encounter Issues setting up the database if your database server is not setup correctly. This could cause the LiLHash File Integrity Monitor to become unresponsive. Review the Quick Start directions to make sure that you have not missed any steps.
If you cannot create file paths with LiLHash, the most likely cause if that you are not using a designated service account with the appropriate permission to access the file resources that you need. Assign a designated sql service account to your sql server instance with the appropriate permissions. This is easily remedied with an active directory service account.
You requested a key to use the LiLHash File Integrity Monitor and did not receive it. Check in your Junk E-mail, the trial key could be there. Also check with the IT Staff to see if the key request was blocked by an e-mail filter. The key request file is send out as a .TXT file. If you cannot get a key file through your company's e-mail system, you may choose an alternate e-mail address so you can receive your trial key. If you are having issues obtaining a trial key send an e-mail to Siraoops@outlook.com and let us know so we can assist you.
Antivirus software or Windows Defender may block the running of this software. Add the appropriate exception to allow this software to be executed.
Make sure resolution is greater than 1366x768 or display may not appear correctly.
Do not magnify text or display may not appear properly.
Backup will fail if the Sql Server Service does not have folder privileges to the backup folder that you select. To resolve the issue make the SQL Server Service use the account with the appropriate privilege to start the service.
Make sure that the account you used to login to the computer to run the LiLHash Console has the appropriate security permissions to access each servers windows system32 folder.
If you run the main LiLHash application and there is no data on any of the displays this could mean that the LiLHash.cfg is missing or does not contain the correct data. The LiLHash.cfg files should be in the directory with the rest of the LiLHash files. The file should contain two lines. The first line must be the name of the server hosting the database. The second line is the name of the database LiLHash. This situation could occur if you wish to run the LiLHash application on a different computer than where the console runs.
If you have specified a relay server and you are not receiving an e-mail alerts or texts, make sure you are allowing the server that runs the LiLHash and the LiLHash Console the ability to relay off of your mail server.
If you stop the Analysis on the LiLHash Control Console, the program will not stop immediately. It will have to finish its current process before bringing the program to a halt.
Columns in the list display can be used to sort the data provided that the entire column has no empty entries. If there are empty entrees in that column of data displayed do not sort by that column.
To facilitate fast data entry, data entry screens will be cleared after being saved and you can key in the next item without acknowledging unnecessary prompts. Your data you entered has been saved.
If training video will not play you may need a video player. If you are using Windows 10 you can download the Movie and TV app from the Microsoft Store for free!
Duplicate reports may take a long time to be created. The number of files in the data share will be a factor in how long it takes for the report to run. How you pare down the report with the filters may dramatically reduce the amount of time to create the report. For example creating an unpared down duplicates report of 250,000 files takes about 50 minutes. A report using the various filters can only take minutes to complete. It is best to create duplicate reports with an objective in mind.
If no report logs for a server are not being created, check the log path for the server. Select Edit Servers option to correct the log path for the server having the report issue.
If you specify alerts for a server but you do not setup the alert path, no Alerts will be saved for ANY server. Make sure you setup the path to store your Alerts.
If you have specified that you do not want alerts for a server, it will still show up in the LiLHash Console Display as an alert should there be any missing or modified files. However no alert log will be created for the server. If you have specified that you want alerts for the server an alert log will be created for the server provided that you have entered in an alert log path in the system setup.
When a Server is off-line and LilHash attempts to scan it, all files will be declared missing. If the server is going to be down during the designated scanning time , turn off scanning for this server so the server will not be scanned. This will prevent you from receiving an invalid report. Edit the Server and select N for Analyze. The server will be passed over.
If you are adding a share and the circle spins for a long time and nothing happens. Afterwards you will get a message that The Share Path Could Not Be Found. This occurs because the firewall is blocking access to the share. Enable the firewall rule Enable File and Printer Sharing (SMB-In) on Windows 2016 Server. You can limit the scope of this rule by clicking on the Scope tab. Then select These IP Addresses and add the address of every computer you run the LiLHash software on.
If Baseline operation was skipped or not successful, the previous Baseline will be used for the analysis.
If you enter in a server path in the Add a Server Path data entry screen and and you are told the path is invalid when it is a valid path, try an alternate way to enter in the path using an administrative share instead.
The File locator total file size for all the files located in the search may not be correct. This is due to the fact that the file sizes are taken out of the database and are accurate as of the last baseline performed.
Viewing Baseline and Scan reports through the report viewer may be slow. Some of these reports may be quite large and will take time to load. You may see a Not Responding message in the upper left. This is normal and can be ignored. You can wait for the report to display or you can abort the LiLHash adminstrative program and review the report with the windows notepad.
Virtual Machine issues...
If you select Analyze Servers from the Main Menu and the LiLHash Control App and the LiLHash Console do not start, you can run this programs directly by double clicking on LiLHashControl.exe and LiLHashConsole.exe respectively.
If the LiLHash Control App does not display properly after being minimized just refresh display by minimizing program to the taskbar and reselecting program from the task bar. You can also restart the program.
Scanning, Baselining or Alert Issues...
A Scan will be skipped if there is no baseline.
A Scan or Baseline can be skipped if the LiLHash Console is busy performing an operation. Make sure you have a large enough time Window for LiLHash to get to your specified operation.
A Scan will be skipped if you change the filemask of a custom file type. By changing the file mask for a share you will invalidate the current baseline. A new baseline will need to be created for the share before the next scan can be done. The old baseline for the share will be removed automatically and a new baseline will be trigged to occur on the current schedule. If this share is actively being scanned when the filemask is changed you will see a message in the message area saying that the scan was aborted.
If you change the Recurse option specified for a path, that will invalidate the baseline for that share. A new baseline will need to be created for the share before the next scan can be done. The old baseline will be removed automatically for the share and a new baseline will be trigged to occur on the current schedule. If the share is actively being scanned when the recurse option is changed you will see a message in the message area saying that the scan was aborted.
If a share is deleted at the time that share is actively being scanned, the scan will be aborted and processing will continue for the next share of that server or move on to the next server. You will see a message in the message area saying that the share was deleted.
Do not modify a share's filemask or recurse options while the baseline is actively being created for the share. If you have performed this action cancel the baseline for the share to allow the new options you have selected to go into effect on the next pass for that share. If you didn't cancel the baseline before it completed, edit the share and change the baseline option to Y. This will create a new baseline for the share on the next pass.
If both a baseline and scan are scheduled to occur, only one operation is performed per pass working with the server share. The operation that will be done is the baseline. The scan will be done in the following pass for the server share. Baseline operations are given priority.
Make sure the account running the LiLHash Console has sufficient privileges on the servers you wish to baseline and scan.
If you stop a scanning operation, the share stats for the scan that was stopped will not be updated.
If you are baselining a directory that contains one or more files that are always changing, these may be good files for exemption status. By exempting certain files this will eliminate false alarms. Examine your alarms and determine if adding exemptions will help. Partial and exact matches can be used for exemptions. Becareful with partial matches as you may exempt more files than desired.
If the built-in file masks do not include the files you need to scan, create a custom file mask that will meet all your needs. If you are scanning files that should never be changed use the Custom - Hash and Deletes, if you are scanning data files that can be changed but not deleted use the Custom - Deletes Only file mask option.
On the LiLHash Console you may notice that the server progress bar remains all the way to the right sometimes. This occurs if the server has only one share. This is normal. The server progress bar will be more accurate when a server has more than one share.
If the LiLHash Console will not start, make sure the LiLHash Control app's Analyze is set to Y. Then Click on the Analyze button on the LiLHash Console.
If you click on the LiLHash Console on the taskbar and it will not maximize, check the LiLHash Control app and make sure Maximize is set to Y. If Maximize is set to Y already and you are in the middle of a baseline operation, you will have to wait for this to complete before the LiLHash Console will be maximized.
In the LiLHash Console the Current Server Progress bar typically stays all the way to the right when the server has just one share. This is normal. This progress will be more informative when the server has more than one share.
In the LiLHash Console the Quantity Found counter is updated with every 1000 files encountered for shares with less or equal than 10,000 files. For shares with 10,001-50,000 files the Quantity Found counter is updated with every 2,000 files encountered. For shares with 50,001-100,000 files the Quantity Found counter is updated with every 3,000 files encountered. For shares with 100,001-200,000 files the Quantity Found counter is updated with every 4,000 files encountered. For shares with 200,001-300,000 files the Quantity Found counter is updated with every 5,000 files encountered. For shares with more than 300,000 files the Quantity Found counter is updated with every 10,000 files encountered. This Quantity Found update frequency is by design to prevent slowing down the Scanning process unnecessarily while still providing real-time status of the scan.
If a share is deleted, LiLHash will cancel the scanning operation as soon as possible if it is actively scanning that share. If the baseline is invalidated due to a filemask change or a recurse option change when editing an actively scanned server share, the scan will be terminated as soon as possible.
If the control panel app appears unresponsive after you make a selection, keep in mind that your selections will not be processed immediately. The LiLHash Console will perform your requests as soon as it can. The larger the scan being scanned, the longer it will take the LiLHash Console to respond. This is intentional not to slow down the scanning speed of the LiLHash Console.
During a baseline operation the LiLHash Console may state Not Responding. This is normal and should be allowed to continue. If you click on the LiLHash Console at this time it may turn white. You must wait for the operation to complete for the Not Responding message to disappear and the display to return to normal.
After a baseline operation gets beyond a certain point in its processing you will not be able to abort the operation. If the LiLHash Console states Not Responding you will need to wait for the operation to complete. If you click on a Not Respondng LiLHash Console it will turn white. Allow it to complete and the display will return to normal. If it is an emergency and you need to stop the baseline processing immediately, you can end the LiLHash Console task in the Windows Task Manager.
Very large shares that are being prepared for scanning may cause the LiLHash Console to state not responding briefly. This is normal and can be ignored.
Deleting a Server from the LiLHash File Integrity Monitor does not delete the server. It just removes the server from automated Baseline and Scanning operations.
Deleting a Share/Path from the LilHash File Integrity Monitor does not delete the Share/Path. It just removes the Share/Path from automated Baseline and Scanning operations.
View Baseline and Scan Summaries and Reports will not sort on the numeric columns. This is a known issue.
View Alert Summaries and Reports will not sort on numeric columns. This is a known issue.
View Alert Summaries and Reports will load a report slowly if it contains thousands of entries. You can wait patiently or you can go to the actual location of report and view it there with the notepad.
View Baseline and Scan Summaries and Reports will load a report slowly if it contains thousands of entries. You can wait patiently or you can go to the actual location of report and view it there with the notepad.
If you rename the computer that is running LiLHash the Analysis Console, the analysis console no longer works. To resolve this issue rename the portion of the .key file containing the old computer name with the new computer name.
If you don't get e-mail alerts for a server, make sure that you assign that server to your contacts.