Access History

Forensic search across persisted hourly summaries, per subscription.

Last updated Aug 14, 2026View as Markdown

Overview

Access History answers questions about the past. Where Access Logs streams individual connections as they happen, this page searches summaries that the agent rolls up per subscription, per server, per hour and writes to the database. That makes it the right tool for “did this subscription ever reach that domain”, long after the live log has scrolled away.

Before you start

  • Data arrives with a deliberate delay. The agent buffers a completed hour before shipping it, controlled by access_log_grace_minutes in Settings → Data Retention. A higher value tolerates write-buffer lag and log rotation gaps; a lower one puts data here sooner, at the cost of dropping late entries.
  • Each hourly row stores a capped top-N of domains and IPs, set by the per-hour caps in the same settings group. Lowering a cap does not shrink rows already on disk, so only new hours are affected.
  • Retention is governed by retention_access_log_days.

Steps

  1. Open Server → Access History from the sidebar.
  2. Pick the scope: one subscription, or several at once.
  3. Set the date range you want to search.
  4. Type at least two characters into the search box to match a domain, an IP or a rejected host.
  5. Read the results, where the overview summarises the scope and the heatmap shows when activity clustered.
  6. Press Esc to dismiss the search surface.

Troubleshooting

The last hour or two is missing. That is expected: an hour is only shipped after the grace window closes. Check access_log_grace_minutes in Settings → Data Retention if the gap is larger than you want.

A domain you know was visited does not appear. Per-hour top-N caps mean only the busiest domains and IPs in each hour are stored. Raise access_log_max_domains_per_hour if you need a longer tail, though it affects new hours only.