Detect "login / connection" events from Tailscale package logs

[netmind]

I've set up tailscale on my pfsense to allow me to occasionally connect back to my home network from the road. I would like to set up some log monitoring to alert me when a remote device logs into / connects to my home network. I've already set up tailscale webhook to slack to alert me. This covers Tailnet mgmt events like nodes being added, policy changes etc. but not when a device logs in / re-connects.

I have the tailscale instance on pfsense sending logs to Graylog and saw that the following entry is sometimes made when an approved device connects to my tailnet.

tailscaled[55722]: 2025/03/23 20:18:36 wgengine: idle peer [TdseH] now active, reconfiguring WireGuard

Unfortunately I've found that it doesn't always create the entry (I can't tell why).

Is there a better way to detect connection/login events?