Browser history logs

Most popular browsers keep a log of the browsing history in an SQLite database. Information in this database includes the URL that was accessed, the title of the page, the time when the page was visited, and the number of times it was accessed.

This guide explains how to collect and process browser history logs with NXLog Agent using the ODBC input module.

Browser history database location and format

The browsing history database is located in the user’s profile folder and the path depends on the browser and operating system. The following sections cover the details of the databases used by Google Chrome, Mozilla Firefox, and Microsoft Edge browsers.

Google Chrome history location and details

Chrome history is stored in an SQLite database, the filename is History and can be found in the following locations:

Microsoft Windows Vista, 7, 8, 10, 11: C:\Users\<username>\AppData\Local\Google\Chrome\User Data\<profile>\History
Linux/Unix (native package installation): /home/<username>/.config/google-chrome/<profile>/History
macOS: /Users/<username>/Library/Application Support/Google/Chrome/<profile>/History

The tables containing the Chrome browsing history in the History database are named urls and visits. Data from these tables can be joined to retrieve the URL, page title, and time it was accessed.

Table 1. Chrome history - *urls* table structure
Column	Type	Description
`id`	`INTEGER`	Primary key, a unique ID for the record
`url`	`LONGVARCHAR`	URL that was accessed
`title`	`LONGVARCHAR`	Title of the website
`visit_count`	`INTEGER`	Number of times the URL was accessed
`typed_count`	`INTEGER`	Number of times the user accessed this website by typing the URL in the address bar
`last_visit_time`	`INTEGER`	Timestamp in microseconds when the website was last visited

Table 2. Chrome history - *visits* table structure
Column	Type	Description
`id`	`INTEGER`	Unique ID for the record
`url`	`INTEGER`	ID corresponding to a record in the `urls` table
`visit_time`	`INTEGER`	Timestamp in microseconds when the website was visited

Table 3. Example data from joined *visits* and *urls* tables
id	url	title	visit_time
`100`	`https://www.nxlog.co`	High Performance Log Collection Solutions	`13250071947070670`

Mozilla Firefox history location and details

Mozilla Firefox history is stored in an SQLite database, the filename is places.sqlite and can be found in the following locations:

Microsoft Windows Vista, 7, 8, 10, 11: C:\Users\<username>\AppData\Roaming\Mozilla\Firefox\Profiles\<profile>\places.sqlite
Linux/Unix (native package installation): /home/<username>/.mozilla/firefox/<profile>/places.sqlite
macOS: /Users/<username>/Library/Application Support/Firefox/Profiles/<profile>/places.sqlite

The tables containing the Firefox browsing history in the places database are named moz_places and moz_historyvisits. Data from these tables can be joined to retrieve the URL, page title, and time it was accessed.

Table 4. Firefox history - *moz_places* table structure
Column	Type	Description
`id`	`INTEGER`	Primary key, a unique ID for the record
`url`	`LONGVARCHAR`	URL that was accessed
`title`	`LONGVARCHAR`	Title of the website
`visit_count`	`INTEGER`	Number of times the URL was accessed
`typed`	`INTEGER`	Number of times the user accessed this website by typing the URL in the address bar
`last_visit_date`	`INTEGER`	Timestamp in microseconds when the website was last visited

Table 5. Firefox history - *moz_historyvisits* table structure
Column	Type	Description
`id`	`INTEGER`	Primary key, a unique ID for the record
`place_id`	`INTEGER`	ID corresponding to a record in the `moz_places` table
`visit_date`	`INTEGER`	Timestamp in microseconds when the website was visited

Table 6. Example data from joined *moz_historyvisits* and *moz_places* tables
id	url	title	visit_date
`100`	`https://www.nxlog.co`	High Performance Log Collection Solutions	`1604932243415000`

Microsoft Edge (v79+) history location and details

Microsoft Edge history is stored in an SQLite database, the database filename is History and can be found in the following location:

Microsoft Windows Vista, 7, 8, 10, 11: C:\Users\<username>\AppData\Local\Microsoft\Edge\User Data\<profile>\History

The tables containing the Microsoft Edge browsing history in the History database are named urls and visits. Data from these tables can be joined to retrieve the URL, page title, and the time it was accessed.

Table 7. Microsoft Edge history - *urls* table structure
Column	Type	Description
`id`	`INTEGER`	Primary key, a unique ID for the record
`url`	`LONGVARCHAR`	URL that was accessed
`title`	`LONGVARCHAR`	Title of the website
`visit_count`	`INTEGER`	Number of times the URL was accessed
`typed_count`	`INTEGER`	Number of times the user accessed this website by typing the URL in the address bar
`last_visit_time`	`INTEGER`	Timestamp in microseconds when the website was last visited

Table 8. Microsoft Edge history - *visits* table structure
Column	Type	Description
`id`	`INTEGER`	Primary key, a unique ID for the record
`url`	`INTEGER`	ID corresponding to a record in the urls table
`visit_time`	`INTEGER`	Timestamp in microseconds when the website was visited

Table 9. Example data from joined *visits* and *urls* tables
id	url	title	visit_time
`100`	`https://www.nxlog.co`	High Performance Log Collection Solutions	`13250071947070670`

Collecting browser history logs

The examples below demonstrate how to collect browser history logs.

Make sure that the machine running NXLog Agent has the SQLite ODBC driver installed:

On Windows, install an SQLite3 ODBC driver and ensure the driver name matches the value specified in the ConnectionString directive.
On Linux/Unix systems, install the SQLite ODBC driver using your distribution’s package manager. For example, the libsqliteodbc package on Debian/Ubuntu-based systems.

Example 1. Collecting Google Chrome browsing history logs on Windows with NXLog Agent

This configuration uses the Exec extension to periodically run a batch script that copies the History database to a new location. This is done to avoid cases when the database is locked by Google Chrome. The copied database is then processed by the ODBC input module. The database does not contain fields that identify the user, but NXLog Agent automatically adds the name of the machine to each event record.

You can use this configuration for Microsoft Edge by changing the location of the original browser history database.

nxlog.conf

<Extension json>
    Module              xm_json
</Extension>

<Extension exec>
    Module              xm_exec
    <Schedule>
        Every           30 min
        <Exec>
            odbc->module_stop();
            sleep(5000000);
            exec("C:\scripts\copy_chrome_db.cmd"); (1)
            odbc->module_start();
        </Exec>
    </Schedule>
</Extension>

<Input odbc>
    Module              im_odbc
    PollInterval        1200
    ConnectionString    DRIVER=SQLite3 ODBC Driver; \
                        Database=C:\logs\History_Chrome;Version=3;
    SQL                 SELECT visits.id AS id, \
                        DATETIME(ROUND(visits.visit_time / 1000000-11644473600), \(2)
                        'unixepoch', 'localtime') AS EventTime, \
                        urls.url AS URL, \
                        urls.title AS Title \
                        FROM visits \
                        INNER JOIN urls ON visits.url = urls.id \
                        WHERE visits.id > ?
    Exec                $Hostname = hostname();
    Exec                to_json();
</Input>

1	You must save `copy_chrome_db.cmd` in the path specified in the `Exec` directive. The user running NXLog Agent must have permission to execute the file and read the `History` file.
2	Google Chrome saves `visit_time` in microseconds since 1601-01-01 (Windows epoch). The SQL `DATETIME` function converts this to a datetime string in the local time zone.

copy_chrome_db.cmd

@echo off
copy "%LOCALAPPDATA%\Google\Chrome\User Data\Default\History" C:\logs\History_Chrome /Y >nul

Output sample

{
  "id": 100,
  "EventTime": "2026-03-26 14:12:18",
  "URL": "https://nxlog.co",
  "Title": "High Performance Log Collection Solutions",
  "Hostname": "PC1",
  "EventReceivedTime": "2026-03-26T14:48:10.360819+03:00",
  "SourceModuleName": "odbc",
  "SourceModuleType": "im_odbc"
}

Example 2. Collecting Mozilla Firefox browsing history logs on Linux Ubuntu with NXLog Agent

This example configuration uses the Exec extension to periodically copy the places.sqlite database to a new location. This is done to avoid cases when the database is locked by Mozilla Firefox. The copied database is then processed by the ODBC input module. The database does not contain fields that identify the user, but NXLog Agent automatically adds the name of the machine to each event record.

nxlog.conf

define FDBPATH /home/<user>/.mozilla/firefox/<profile>/places.sqlite (1)
define FDBCOPY /tmp/places.sqlite (2)

<Extension json>
    Module              xm_json
</Extension>

<Extension exec>
    Module              xm_exec
    <Schedule>
        Every           30 min
        <Exec>
            odbc->module_stop();
            sleep(5000000);
            exec("/bin/sh", "-c", "cp %FDBPATH% %FDBCOPY%"); (3)
            odbc->module_start();
        </Exec>
    </Schedule>
</Extension>

<Input odbc>
    Module              im_odbc
    PollInterval        1200
    ConnectionString    DRIVER=SQLite3;Database=%FDBCOPY%;
    SQL                 SELECT moz_historyvisits.id AS id, \
                        DATETIME(ROUND(moz_historyvisits.visit_date / 1000000), \(4)
                        'unixepoch', 'localtime') AS EventTime, \
                        moz_places.url AS URL, \
                        moz_places.title AS Title \
                        FROM moz_historyvisits \
                        INNER JOIN moz_places ON \
                        moz_historyvisits.place_id = moz_places.id \
                        WHERE moz_historyvisits.id > ?
    Exec                to_json();
</Input>

1	Path of the `places.sqlite` database. The user running NXLog Agent must have permission to read the file.
2	Path where the database will be copied for processing. The user running NXLog Agent must have permission to write the file.
3	Copies the file to the new location to avoid access being locked.
4	Mozilla Firefox saves `visit_date` in microseconds (Unix epoch). The SQL `DATETIME` function converts this to a datetime string in the local time zone.

Output sample

{
  "id": 100,
  "EventTime": "2026-03-26 18:45:12",
  "URL": "https://nxlog.co",
  "Title": "High Performance Log Collection Solutions",
  "EventReceivedTime": "2026-03-26T18:56:57.272942+03:00",
  "SourceModuleName": "odbc",
  "SourceModuleType": "im_odbc",
  "Hostname": "PC1"
}

Disclaimer

While we endeavor to keep the information in our guides up to date and correct, NXLog makes no representations or warranties of any kind, express or implied about the completeness, accuracy, reliability, suitability, or availability of the content represented here. We update our screenshots and instructions on a best-effort basis.

NXLog does not guarantee that any scripts provided in our guides are error-free, secure, or suitable for any specific environment. Use of the scripts is at your own risk. In no event shall NXLog be liable for any damages or losses arising from using these scripts.

The accurateness of the content was tested and proved to be working in our lab environment at the time of the last revision with the following software versions:

NXLog Agent version 6.13.10718
Ubuntu version 22.04 LTS
Microsoft Windows 11
Google Chrome version 146.0.7680.72
Mozilla Firefox version 148.0.2
Microsoft Edge version 145.0.3800.97

Last revision: 1 April 2026