diff --git a/Makefile b/Makefile
index 55c3e98..ad8155e 100644
--- a/Makefile
+++ b/Makefile
@@ -41,3 +41,6 @@ portmap.pb.go: portmap.proto
 
 list:
 	curl "http://localhost:2522/list"
+
+save:
+	curl "http://localhost:2522/save"
diff --git a/config.go b/config.go
index 37b3174..0e37f83 100644
--- a/config.go
+++ b/config.go
@@ -60,6 +60,46 @@ func ConfigLoad() *Portmaps {
 	return p
 }
 
+func EventLoad() *Events {
+	pb := new(Events)
+	var fullname string
+	base, _ := filepath.Split(argv.Config)
+	fullname = filepath.Join(base, "events.pb")
+
+	var data []byte
+	var err error
+	if data, err = loadFile(fullname); err != nil {
+		log.Warn("event file failed to load", err)
+		// something went wrong loading the file
+		return pb
+	}
+
+	if data == nil {
+		return pb
+	}
+	if err = pb.Unmarshal(data); err != nil {
+		log.Warn("unmarshal failed on config file", err)
+		return pb
+	}
+
+	log.Log(INFO, "gus.EventLoad() has", pb.Len(), "port mappings")
+	return pb
+}
+
+func (e *Events) Save() {
+	var fullname string
+	base, _ := filepath.Split(argv.Config)
+	fullname = filepath.Join(base, "events.pb")
+
+	data, err := e.Marshal()
+	if err != nil {
+		log.Info("proto.Marshal() failed", err)
+		return
+	}
+	log.Info("proto.Marshal() worked len", len(data))
+	configWrite(fullname, data)
+}
+
 func loadFile(fullname string) ([]byte, error) {
 	data, err := os.ReadFile(fullname)
 	if errors.Is(err, os.ErrNotExist) {
diff --git a/doGui.go b/doGui.go
index 9240cf6..09bb828 100644
--- a/doGui.go
+++ b/doGui.go
@@ -52,11 +52,8 @@ func doGui() {
 	})
 
 	grid.NewButton("Events", func() {
-		log.Info("todo: start a list here!")
-		pm := me.portmaps.InsertByListen(5556)
-		pm.Connect = "haha. gotcha"
-		pm.Enabled = true
-		me.portmaps.ConfigSave()
+		log.Info("event log is len =", me.events.Len())
+		me.events.Save()
 	})
 
 	// sit here forever refreshing the GUI
diff --git a/http.go b/http.go
index c1a4b25..8a733d3 100644
--- a/http.go
+++ b/http.go
@@ -60,6 +60,12 @@ func okHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if route == "/save" {
+		log.Info("event log is len =", me.events.Len())
+		me.events.Save()
+		return
+	}
+
 	// toggle logging flags
 	if route == "/flag" {
 		log.HttpMode(w)
diff --git a/main.go b/main.go
index c8ac253..dab140e 100644
--- a/main.go
+++ b/main.go
@@ -11,9 +11,11 @@ import (
 	"os"
 	"time"
 
+	"github.com/google/uuid"
 	"go.wit.com/dev/alexflint/arg"
 	"go.wit.com/gui"
 	"go.wit.com/log"
+	timestamppb "google.golang.org/protobuf/types/known/timestamppb"
 )
 
 var VERSION string
@@ -31,10 +33,12 @@ func main() {
 		pp.WriteHelp(os.Stdout)
 		os.Exit(0)
 	}
+	log.Info("tmp hack", uuid.New().String())
 
 	me = new(gusconf)
 	me.pollDelay = 10 * time.Second
 	me.portmaps = ConfigLoad()
+	me.events = EventLoad()
 
 	if me.portmaps == nil {
 		me.portmaps = NewPortmaps()
@@ -103,9 +107,18 @@ func handleConnection(clientConn net.Conn, where string) {
 		return
 	}
 	defer targetConn.Close()
-	log.Printf("Connected to target server: %s where = %s\n", targetConn.RemoteAddr(), where)
+	// log.Printf("Connected to target server: %s where = %s\n", targetConn.RemoteAddr(), where)
+	log.Printf("Connected to client: %s where = %s\n", clientConn.RemoteAddr(), where)
+
+	e := new(Event)
+	e.Address = fmt.Sprintf("%s\n", clientConn.RemoteAddr())
+	e.Where = where
+	e.Ctime = timestamppb.New(time.Now())
+
+	me.events.Append(e)
 
 	// Bidirectional copy of data
 	go io.Copy(targetConn, clientConn) // Client -> Target
 	io.Copy(clientConn, targetConn)    // Target -> Client
+	e.Etime = timestamppb.New(time.Now())
 }
diff --git a/portmap.proto b/portmap.proto
index 7b29545..ac543e3 100644
--- a/portmap.proto
+++ b/portmap.proto
@@ -2,27 +2,31 @@ syntax = "proto3";
 
 package gus;
 
+import "google/protobuf/timestamp.proto"; // Import the well-known type for Timestamp
+
 message Event {
-        string             hostname     = 1;
-        string             version      = 2;
+        string                      hostname     = 1;  // the hostname of the client
+        string                      address      = 2;  // the IP address from the client
+        string                      where        = 3;  // where gus was sending the client traffic
+        google.protobuf.Timestamp   ctime        = 4;  // when the socket opened
+        google.protobuf.Timestamp   etime        = 5;  // when the socket ended
 }
 
-message Events {
-        string             uuid         = 1;
-        string             version      = 2;
-        repeated Event     events       = 3;
+message Events {                                       // `autogenpb:marshal` `autogenpb:gui` `autogenpb:nomutex`
+        string                      uuid         = 1;
+        string                      version      = 2;
+        repeated Event              events       = 3;
 }
 
 message Portmap {
-        int64              listen       = 1;  // `autogenpb:unique`
-        string             connect      = 2;  // `autogenpb:unique`
-        bool               enabled      = 3;
-        string             uuid         = 4;
+        int64                       listen       = 1;  // `autogenpb:unique`
+        string                      connect      = 2;  // `autogenpb:unique`
+        bool                        enabled      = 3;
+        string                      uuid         = 4;
 }
 
-message Portmaps {                            // `autogenpb:marshal` `autogenpb:gui` `autogenpb:nomutex`
-        string             uuid         = 1;  // `autogenpb:uuid:49a865ea-292d-48fd-8dc2-d0f82d5fd016`
-        string             version      = 2;  // `autogenpb:version:v0.0.1`
-        repeated Portmap   portmaps     = 3;
-        Events             events       = 4;
+message Portmaps {                                     // `autogenpb:marshal` `autogenpb:gui` `autogenpb:nomutex`
+        string                      uuid         = 1;  // `autogenpb:uuid:49a865ea-292d-48fd-8dc2-d0f82d5fd016`
+        string                      version      = 2;  // `autogenpb:version:v0.0.1`
+        repeated Portmap            portmaps     = 3;
 }
diff --git a/structs.go b/structs.go
index 1cf6370..d96bf0b 100644
--- a/structs.go
+++ b/structs.go
@@ -17,6 +17,7 @@ var me *gusconf
 type gusconf struct {
 	myGui        *gui.Node     // the base of the gui
 	portmaps     *Portmaps     // the portmap window
+	events       *Events       // the event log
 	portwin      *stdTableWin  // the portwin window
 	urlbase      string        // the dns name for the zookeeper
 	hostname     string        // my hostname