logs are spammed with Accept: TCP lines

[toppk]

What is the issue?

I get 250 of these per hour, and they don't really provide any information or are documented in any way what it indicates.

May 16 15:17:21 myhost tailscaled[831]: Accept: TCP{myip:22 > myip:46062} 344 ok out

this is the code:

https://github.com/tailscale/tailscale/blob/main/wgengine/filter/filter.go#L402

I don't really see any way to control the logging of these accepts in isolation of all other logging. Given I'm not even sure what the value is of this repeated logging (it would make sense to log this once at the start of the tcp connection, rather than repeatedly as long as the connection is open) I would like to turn this off, without disabling the rest of the logging.

Steps to reproduce

just run a client

Are there any recent changes that introduced the issue?

been around forever

OS

Linux

OS version

fedora 40

Tailscale version

1.66.1

Other software

No response

Bug report

BUG-22a4f175fd1054705219ad3bc2cbd15592258546c8a5eaab96d63ee8b1c5cf6c-20240516154642Z-807e8bef2b669efb

[bobmarley2021]

This is something that has been happening for a while. I ran out of space on / one day a few months ago and wondered why... a quick investigation found 50GB+ of archived logs spammed with this.

A temp workaround, although not ideal is to run a quick bash script:

#!/bin/bash

echo Removing Kern log, Syslog and archived....

sudo rm -rf /var/log/kern.log
sudo rm -rf /var/log/kern.log.*
sudo rm -rf /var/log/syslog
sudo rm -rf /var/log/syslog.*

echo Done.

And add to cron if you so desire:

0 5 * * 1 sh /home/user/del-ts-logs.sh

The above is for Ubuntu (and probably Debian and others) I also use Alpine, so logs are different - you can just do this cron:

0 5 * * 1 rm /var/log/tailscaled.log-*

But I totally agree with this... it needs sorting.