Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Detect "login / connection" events from Tailscale package logs

    Scheduled Pinned Locked Moved Tailscale
    1 Posts 1 Posters 109 Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • N
      netmind
      last edited by

      I've set up tailscale on my pfsense to allow me to occasionally connect back to my home network from the road. I would like to set up some log monitoring to alert me when a remote device logs into / connects to my home network. I've already set up tailscale webhook to slack to alert me. This covers Tailnet mgmt events like nodes being added, policy changes etc. but not when a device logs in / re-connects.

      I have the tailscale instance on pfsense sending logs to Graylog and saw that the following entry is sometimes made when an approved device connects to my tailnet.

      tailscaled[55722]: 2025/03/23 20:18:36 wgengine: idle peer [TdseH] now active, reconfiguring WireGuard

      Unfortunately I've found that it doesn't always create the entry (I can't tell why).

      Is there a better way to detect connection/login events?

      1 Reply Last reply Reply Quote 0
      • First post
        Last post
      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.