Where are the Last WebAdmin Sessions records actually stored, and how can they be cleared?

The records are stored in two locations: the reporting database (table confd_sessions) and the log file /var/log/confd.log. To clear them, you can delete entries from confd_sessions using SQL commands via psql (e.g., `DELETE FROM confd_sessions WHERE facility IN ('webadmin','acc-agent','acc_sso')`) and remove corresponding lines from the log file. This forensic cleaning process is detailed in the Sophos UTM Analysis - Clearing Last WebAdmin Sessions Records article.