# Access History

> Forensic search across persisted hourly summaries, per subscription.

Source: https://joinnasnet.com/en/guides/nasnet-linux/server/access-history/
Last updated: 2026-08-14

---

## Overview

**Access History** answers questions about the past. Where
[Access Logs](/en/guides/nasnet-linux/server/access-logs/) streams individual
connections as they happen, this page searches summaries that the agent rolls up
per subscription, per server, per hour and writes to the database. That makes it
the right tool for "did this subscription ever reach that domain", long after
the live log has scrolled away.

## Before you start

- Data arrives with a deliberate delay. The agent buffers a completed hour
  before shipping it, controlled by `access_log_grace_minutes` in
  **Settings → Data Retention**. A higher value tolerates write-buffer lag and
  log rotation gaps; a lower one puts data here sooner, at the cost of dropping
  late entries.
- Each hourly row stores a capped top-N of domains and IPs, set by the per-hour
  caps in the same settings group. Lowering a cap does not shrink rows already
  on disk, so only new hours are affected.
- Retention is governed by `retention_access_log_days`.

## Steps

1. Open **Server → Access History** from the sidebar.
2. Pick the scope: one subscription, or several at once.
3. Set the date range you want to search.
4. Type at least two characters into the search box to match a domain, an IP or
   a rejected host.
5. Read the results, where the overview summarises the scope and the heatmap shows
   when activity clustered.
6. Press **Esc** to dismiss the search surface.

## Troubleshooting

**The last hour or two is missing.** That is expected: an hour is only shipped
after the grace window closes. Check `access_log_grace_minutes` in
**Settings → Data Retention** if the gap is larger than you want.

**A domain you know was visited does not appear.** Per-hour top-N caps mean only
the busiest domains and IPs in each hour are stored. Raise
`access_log_max_domains_per_hour` if you need a longer tail, though it affects new
hours only.

## Related

- [Access Logs](/en/guides/nasnet-linux/server/access-logs/)
- [Subscriptions](/en/guides/nasnet-linux/subscriptions/)
- [Settings](/en/guides/nasnet-linux/settings/)