Security events
Watchtower records connection attempts that should not have happened. They appear on the Security events tile on the Overview page, newest first.
Empty is the expected state.
Events are recorded and displayed. Watchtower does not email, page, or notify you when one occurs. This tile is only useful if somebody looks at it.
Notification support does not exist yet.
The three kinds
Duplicate machine
Two live connections presenting the same machine's credential.
Almost always a cloned machine or a copied credential file — a VM imaged with a credential still in it, or a disk restored onto different hardware. See Moving a machine.
If neither applies, treat the credential as compromised: revoke the machine, then re-enroll it to issue a fresh secret.
Detection is not instant. The duplicate is found by a periodic sweep, so expect roughly thirty to ninety seconds rather than immediately.
Account mismatch
A credential valid for one account was presented while claiming to belong to another.
The connection is refused before it can do anything, and the event is recorded against the account that actually owns the credential — so you find out that your credential was used this way, which is the thing worth knowing.
This does not happen by accident. A machine reporting this is one to look at.
Connection refused by IP rules
A valid credential arrived from an address your IP rules exclude.
The common cause is benign: you tightened the rules on a key, and machines enrolled through it no longer pass. A laptop that travelled is the other everyday cause.
The one worth investigating is a machine you believe is at a fixed site being refused — that means it connected from somewhere else.
What to do about one
- Identify the machine.
- Decide whether you can explain it — a clone, a rebuild, a rules change you made, a laptop that travelled.
- If you cannot, revoke the machine. It is reversible; re-enrolling takes a restart.
- If a key looks implicated, revoke it too and issue a replacement with IP rules.
Retention
Automatic expiry of old events is planned but not yet in place, so events currently accumulate. Do not rely on the tile as a permanent audit log either way — if an event matters, record it somewhere you control.