Methods and systems for associating an event log entry with the rule that triggered its creation are described. In one embodiment, an apparatus is described. The apparatus has an event handling device for applying a plurality of rules; an event log with a plurality of log entries, and a hash value appender for appending a hash value log entries. When the event handling device performs an application of one of the rules, an entry is created in said event log, and the hash value generator appends a unique hash value to the entry. The unique hash value corresponds to the rule that was applied.