Reports → Query log (GET /api/v1/queries, every account since
0.6.8) lists the queries of the journal, newest first. Since 0.6.9 the
page reads them from the box a page at a time (50 lines unless the viewer
chooses 10, 25, 75 or 100, see Reports), with the count of
the queries that match its filters: GET /api/v1/queries/page takes the
same filters as GET /api/v1/queries (below; before and after
ignored) with offset and limit (1 to 100, 50 otherwise), and gives
entries (the rows, as below), total, offset (brought back to the
last page when past the end) and limit. Show older queries is gone:
the pager replaces it. Live follows the first page; going to another
page turns it off, and turning it on again goes back to the first page.
While live, the page asks only for the queries newer than its first row
(GET /api/v1/queries?after=), and reads the whole page again when a
page or more came.
An account without the right to read the reports (a member) sees only its
own devices, and the page says so ("Only your devices show here…"): the
devices of its person, those of the groups of devices its account made,
and the device it uses now (by the address of the request) when that one
is given to nobody else — never a device another adult keeps private; a
filter on another device answers 403. An administrator (or an account
that reads the reports) sees the whole network, and its own devices even
when its person did not agree to detailed reports. GET /api/v1/me/devices (every account) gives those own devices, for the
filter of the page; the API token and the warda commands see every
device but the box. The parameters:
before (an id: the rows older than it, GET /api/v1/queries only), search
(part of the name, at most 253 characters; in the last 24 hours unless
from is given), status (all, allowed —
local answers included —, blocked, paused), device, person or
group (the id of a group: its devices), and
from/to (milliseconds). Each row gives the time, the device and its
person (person_name) or, for a device of nobody in particular, its group
(group_name, and group_key for a default group, whose name the
interface translates), the name, the type (A, AAAA, HTTPS…, in a column of its own: the
addresses in grey, the services — HTTPS, SVCB — in violet, the others in
orange), what Warda did and why
(lists, rules, categories, services, hours of Internet), what decided —
origin_kind and origin_value: the list (a list of warda-lists by its
id, base for the ads and trackers, another by its address), the personal
rule, the rule of the device (device), the category, the service, the hours of Internet or a data leak through DNS
(tunnel, its domain), a look-alike name (lookalike, the name
imitated), a spyware (spyware, its domain in the list), a DNS rebinding
(rebinding, the address), a quarantine (quarantine), from 0.8.0 the
restricted mode of an object (restricted, the domain outside its names:
"Outside the names this connected object learned (…)") or a mining pool
(mining, the pool: "Mining pool (…)"), from 0.8.2 the reputation of
the domains (reputation,
<kind>:<category>: "Analysis of Warda: malicious (phishing)"; also in
the detail of a row allowed when the domain was only told) — the answer code
and whether it came from the cache, and from 0.8.0 relayed for a query
of the protection outside the home (1
outside the home, 2 at home through the online service; absent for a
query of the network): the row has the badge outside, and its detail
Path: "Outside the home, through the online service" or "At home,
through the online service" (column relayed of queries, kept when a
secondary of a pair keeps its history). A name of the CSAM category shows
as csam.invalid (see Sensitive categories).
The origin is kept with each query (a
table of origins shared by the queries, emptied with them); the queries
recorded before it existed have none. The devices of the adults who did not agree to
detailed reports are left out (a filter on one of them answers 403), and a
device given to a person shows only from that moment, as in the reports.
limit (1 to 100) shortens a page. The page searches as one types (after
half a second), follows the newest queries every 3 seconds when Live is
on (the default, except on a window of time opened from the dashboard),
asking only what came since the newest row shown (after, the id of that
row), and says when it last did, tints the blocked rows red and
those during a pause amber, and makes a name a rule for the whole network
in one click (Block or Allow, as on the page of the rules). The
filters are kept in the address of the page (#/queries?from=…&device=…).
A row holds on one line: the device, then the column Person / group
(the name of the person of the device, else of its group, nothing else);
the result as a label (Local in violet, Allowed in green,
Blocked in red, Paused in amber) with why beside it — for a
blocked name, why is a label too. The filter Person / group chooses one
person or one group (Everyone by default); the devices kept private
(the adults who did not agree to detailed reports, and the groups their
account made) are not offered in it.
Unknown local name (FR "Nom local inconnu"; it replaces "Name of the
local network · not found") is not an error. Warda answers itself that the
name does not exist (NXDOMAIN, status local) for a local name nobody on
the network has: a single label (nas), a name under .lan, .local,
.home, .internal, .localdomain or home.arpa, from 0.7.10 a name
under the local domain whatever it is, a reverse lookup of a
private address. Such names are never sent to the upstream servers: they
would tell outsiders what is in the house. From 0.8.2 a device of the
protection outside the home that asks from
outside gets the same answer for every name of the home network (the
names of Warda, the local records, the names of the devices, the local
zones). A tooltip on the reason and the
detail of the row say so; when the name looks like one of the local zone
of the router (or is a private reverse lookup) and that zone is not sent
to the router yet, the detail offers a link to Settings → Local
network to let the router answer those names (conditional forwarding,
WARDA_FORWARD).