Connection Log

The Connection Log is the Network Monitor as a dated list: one row for each connection, with its time, app, destination and decision. The app list shows who connects and how much. The log shows when, in order.

Switch to it with Log in the Apps and Log switch at the top of the Network Monitor, or with View › Show Connection Log (⌥⌘L). Choose Apps, or the same menu item again, to go back. Outbound remembers which one you left open.

The log reads the same Range as the app list. It takes the place of the list, the map and the traffic chart until you switch back.

Filtering

The filter field’s prompt is “Filter: app:, host:, country:, continent:, owner:, rule:”. Type a field and a value, then press Return to turn it into a token. Select a token and press Delete to remove it. The fields are the ones described in Search and filters, and the field suggests values from the connections already loaded, such as app:"Safari", host:example.com, country:IE or owner:501.

The button beside the field, Show Parsed Filter, shows how Outbound reads what you typed.

Beside it:

• A menu with All, Allowed, Blocked, Decided by Unapproved Rule, Incoming and Outgoing. Each item shows how many of the loaded connections it holds, under the heading “Counts in loaded results”.
• All, Allowed and Blocked, for the decision.

Pause and follow

While the log follows new connections, the newest rows arrive at the top. Pause stops the list moving so you can read it. Connections that arrive while it is paused are counted on the button, as “N new”. Choose it, or Follow Newest, to jump back to the newest row and follow again.

Selecting a row with the keyboard also holds the order in place, so the row you are reading does not move away.

Following one app

Select an app or a destination, then choose Follow Selection instead of All Connections to show only its connections. Its name appears above the filter. Pin Scope keeps that app or destination while you select and inspect other rows. Its help is “Keep this app or destination selected while you inspect other connections.”

Columns

Time, App, Destination, Decision, Decided By, Port / Protocol and Direction. Policy Version (Diagnostics) is the saved policy version that decided the connection, for troubleshooting. Outbound remembers the column widths and order.

Sorting and grouping

The Sort By and Group By menus are shared with the app list. With Recent Activity, rows are in time order. Group By adds Chronological, the default for the log, to the six two-level groupings.

When a sort other than Recent Activity or a grouping is in use, the footer says “Sort and grouping apply to loaded events.” Byte sorts use the measured totals of each app, because a single connection event carries no byte count.

Row actions

Right-click a row for:

• Block for This App and Allow for This App
• Show in Monitor, to find the app or destination in the app list
• Show Rule, to open the rule that decided it, when a rule did
• Copy Connection

Below those, for the row or for every selected row (Command-click or Shift-click to select several): Inspect, Show in Blocklist, Approve Rules for Selection and Reset Counters for Selection, then a Copy submenu with Names, Process Names, Paths, Hostnames, Domains or IP Addresses, one per line. An item that does not apply is dimmed, and its help says why.

To hide a source or delete its saved history, use the right-click menus in the app list. See Hidden connections.

How much it holds

The log reads the saved connection history. The footer says how long that is kept, such as “Keeping 7 days”, or “Saved history is off”, followed by how many events are loaded. Set the period in Settings › Monitor. Saved history has a 200 MiB limit, plus index storage.

• Load Older, the clock button in the footer, reads the next page of older events.
• The live window keeps the newest 5,000 events. Older events stay in saved history.
• The log shows up to the newest 100,000 events that match. Narrow the filter to look further back.

When events could not be recorded, or a limit was reached, the footer shows a warning, such as “At least N events dropped”. Click it for the details.

With nothing to show, the log says “Connections matching these filters will appear here.”