Web Safety also stores monitoring events in a database, either SQLite (for home deployments) or MySQL / Maria DB (for enterprise deployments). Traffic reports are later built based on this database.
Initially monitoring events are collected in memory and then periodically dumped into /opt/websafety/var/monitor folder as JSON files. The files are uploaded to the monitoring database automatically every 5 seconds (by default) by the /opt/websafety/bin/wsmgrd daemon.
By default only blocked records are stored in the database. This helps to keep the size of the database within certain limits. To adjust stored records, click UI / Traffic Monitor / Settings and select the Persistent tab. After adjusting click Save Changes followed by Save and Restart.
The history tab in UI / Traffic Monitor / History shows last 1000 records from the database.
It is possible to get detailed information about each shown record. Administrator may also search for a specific record by incident id, user name, user ip, host name and other event attributes. The incident id is usually shown on the blocked page and added as as additional header in all blocked HTTP responses.