Muddog connection and relay logs
Muddog stores connection and relay records on your computer when other users use your internet connection. These records help you investigate connections if you suspect misuse. This screen does not show the browsing history of your personal VPN.
View logs in the app
- Expand Settings → Advanced settings.
- Click View logs next to Connection and relay logs.
- Select the Log date (UTC).
- Enter any filters you need and click Search. All filters except the date are optional.
- If there are more results, click Next records. Use Previous to go back a page.
- Expand Raw JSON below an entry to see the event details.
| Filter | What to enter |
|---|---|
| Connection IP | The connecting IP address of the participant who used your connection |
| Destination IP | The IP address of the external server the participant tried to access |
| Destination port | The external server's port number, such as 443 |
| Protocol | All, TCP, or UDP |
| Session ID | An ID identifying a particular sharing connection |
Read dates and times
Both the search date and the times in the results are in UTC. Convert your local time to UTC before choosing a date. For example, Korea Standard Time (KST) is nine hours ahead of UTC. An event at 2 a.m. on October 4 in Korea occurred at 5 p.m. UTC on October 3, so you must search the previous day, October 3.
The screen shows events recorded on the selected UTC date in the order they appear in the file. It does not count the people connected during the day or list every connection that was open at a particular moment.
Interpret the results
A single connection can produce multiple events, such as startup, establishment, keepalive checks, and termination. Do not interpret the Displayed events count as a count of users.
| Event | Meaning |
|---|---|
| Session started / Session connected / Session ended | A sharing connection with another participant started, was established, or ended |
| Session keepalive | A periodic check of the sharing session and its active connections |
| Relay attempt / Relay connected / Relay ended | An attempt, established connection, or termination for communication with an individual destination within a sharing session |
For UDP, Relay connected means the connection is ready to send data; it does not mean the destination server has responded. An ending event may be missing after a power failure or forced shutdown.
If Next records is enabled, continue searching even if the current page has no results. An empty result does not prove that no connection occurred: the date or filters may be wrong, or the retention period may have expired. Records that are damaged or exceed the screen's display limits are reported in the count of records that could not be displayed.
To investigate communication at a particular time, collect the date and time zone, connection or destination IP, port, and protocol, then request support. These records describe IP addresses and sessions; they do not establish a person's identity.
Storage and retention
The installed background service stores records in the following locations:
| Operating system | Storage location |
|---|---|
| Linux | /var/lib/muddog/audit |
| Windows | %ProgramData%\Muddog\audit |
| macOS | /Library/Application Support/Muddog/audit |
The default retention period is 365 days, and records are kept locally for up to 365 days. The default storage limit is 1 GiB.
- Records contain metadata such as connection times, connecting IPs, relay destination IPs, ports and protocols, connection results, and amounts of data sent and received.
- Packet payloads, website URLs, DNS query contents, and TLS contents are not recorded.
- Connection and relay logs are not automatically sent to a central server. Searches run locally, and their filters and results are not automatically attached to regular diagnostic logs or problem reports.
- Expired records are cleaned up while the service is running. If the computer or service was off, cleanup runs when it next starts.
Sharing stops if the storage limit is reached or records cannot be written. Muddog does not keep sharing by automatically overwriting records that are still within their retention period. See sharing troubleshooting.
Viewing logs in the app requires an up-to-date, running service and
permission to access it. Users who can control the service can also view
records: members of the muddog group on Linux, users logged in interactively
to the computer on Windows, and administrator accounts on macOS. Reading
the raw files directly requires administrator privileges.
Uninstalling the package does not automatically delete remaining records. The service no longer performs retention cleanup after removal, so you must decide whether the remaining records are needed and manage them yourself.