When filtering the Web event viewer in the console, for a particular date range, only events from a narrower time period are shown.
Example: You choose to view all Web events from the 'Last 6 months' and only events from the last 1-2 months are shown.
First seen in
Enterprise Console 5.0.0
The total number of Web events available in the database are truncated to a maximum of 1,000,000 (one million) when viewing the alert history in the Console. Therefore the date range you specify in the Console is superseded by the date range of the last one million alerts.
What To Do
It is possible to increase the number of Web events that can be displayed, however it is not recommended.
If there is a strong business case for needing to see more than the last one millions web alerts please contact Sophos Technical Support to enquire about this option, explaining the business need.