Tailscale

Stream Tailscale configuration audit logs and network flow logs to Oodle with Tailscale log streaming (available on the Tailscale Premium and Enterprise plans).

With these logs in Oodle, you can:

• See who changed the configuration of your tailnet, what they changed, and when
• Monitor the connections between the nodes of your tailnet
• Correlate tailnet events with your application logs

Prerequisites

• A Tailscale Premium or Enterprise plan. Log streaming is available only on these plans.
• The Owner, Admin, Network admin, or IT admin role in your tailnet.
• Your Oodle instance ID and API key (see Configuration).

Configuration

You need these values:

• OODLE_INSTANCE: Your Oodle instance ID. Navigate to Settings icon → API Keys page in your Oodle UI to find this value. (Oodle UI links: ap1, us1)
• OODLE_API_KEY: Your Oodle API key for authentication. Navigate to Settings icon → API Keys in your Oodle UI to choose an appropriate key. (Oodle UI links: ap1, us1)

Steps

Each log type has its own stream. Do the steps for each log type that you want to send to Oodle. Each stream uses these values:

Setting	Value
Destination	Splunk
URL	https://<OODLE_INSTANCE>-logs.collector.oodle.ai/services/collector/event
Token	<OODLE_API_KEY>

Configuration audit logs

1. Open configuration log streaming in the Tailscale admin console.
2. Set the values in the table above, then select Start streaming.

Network flow logs

1. Open network flow logs and select Start logging. Tailscale does not stream network flow logs until they are on. If they are already on, skip this step.
2. Open network flow log streaming.
3. Set the values in the table above, then select Start streaming.

Configuration audit logs come when a configuration changes. Network flow logs come in batches while your nodes send traffic.

View the logs

Tailscale logs have the source type tailscale. The service tells the log types apart:

Log type	Service	Message	Oodle UI link
Configuration audit logs	tailscale-configuration	The action, the target and the actor of the change	ap1, us1
Network flow logs	tailscale-network	The node, and the number of flows for each type of traffic	ap1, us1

The fields of each record are in the log field. For example, query log.actor.loginName for the user who made a configuration change, or log.virtualTraffic for the traffic between the nodes of your tailnet.

Dashboard

The Tailscale Monitoring dashboard shows the traffic of each node, peer and connection path, and the configuration audit logs. To add it to your Grafana, open the Tailscale tile (ap1, us1) and select Provision & View Dashboard in the last step. You can do this again: it replaces the copy in Grafana, so you also get the newest version.

Traffic metrics

Oodle makes four counters from the network flow logs. They are the throughput metrics of the Tailscale client, so you get them with no metrics collection on each node:

Metric	Tailscale client metric
oodle_logs_tailscale_outbound_bytes_total	tailscaled_outbound_bytes_total
oodle_logs_tailscale_outbound_packets_total	tailscaled_outbound_packets_total
oodle_logs_tailscale_inbound_bytes_total	tailscaled_inbound_bytes_total
oodle_logs_tailscale_inbound_packets_total	tailscaled_inbound_packets_total

Each counter has these labels:

Label	Value
node	The node that sent the flow log
user	The owner of that node
peer	The node at the other end. If Tailscale does not name it, its address
path	direct_ipv4, direct_ipv6 or derp, as the client metric labels it

For example, the outbound traffic of each node:

sum by (node) (rate(oodle_logs_tailscale_outbound_bytes_total[5m]))

The counters count the traffic on the physical network, which includes the WireGuard overhead. A path through a peer relay shows as a direct path. The counters start when Oodle receives the first flow log of a node, not when the node starts. A node that does not send flow logs has no counters.