ICAP server also stores monitoring events in a database, either SQLite (for home deployments) or MySQL / Maria DB (for enterprise deployments). Traffic reports are later built based on this database.
Initially ICAP server collects monitoring event in memory and dumps these periodically into /opt/websafety/var/monitor folder as JSON files. The files are uploaded to the monitoring database automatically every 5 seconds (by default) by the /opt/websafety/bin/wsmgrd daemon.
By default only blocked records are stored in the database. This helps to keep the size of the database within certain limits. To adjust stored records, click Admin UI / Monitoring / Settings and select the Persistent tab. After adjusting click Save Changes and restart the Web Safety daemon.
The history tab in Admin UI / Monitoring / History shows last 1000 records from the database.
It is possible to get detailed information about each shown record. Administrator may also search for a specific record by incident id, user name, user ip, host name and other event attributes. The incident id is usually shown on the blocked page and added as as additional header in all blocked HTTP responses.