diff --git a/plays/monitoring.yml b/plays/monitoring.yml
index 59e74f37abec2e999e1943358c09da1739150e8e..d813a8669408ba43388bfbc8246ec623f0ebe841 100755
--- a/plays/monitoring.yml
+++ b/plays/monitoring.yml
@@ -77,8 +77,10 @@
 #  roles: ["prometheus-node-exporter-postfix"]
 
 # Monitor logs with mtail
-#- hosts: thot.adm.crans.org
-#  roles: ["mtail"]
+- hosts: tealc.adm.crans.org
+  vars:
+    mirror: '{{ glob_mirror | default({}) | combine(loc_mirror | default({})) }}'
+  roles: ["mtail"]
 
 - hosts: sputnik.adm.crans.org
   roles: ["statping"]
diff --git a/roles/mtail/tasks/main.yml b/roles/mtail/tasks/main.yml
index 814d0c7010f9a3c82d1be127ea2efddc69548303..5a44c99bbe87dba0077a118153614a1e3ac75f3a 100644
--- a/roles/mtail/tasks/main.yml
+++ b/roles/mtail/tasks/main.yml
@@ -1,4 +1,16 @@
 ---
+- name: Pin mtail
+  template:
+    src: "apt/{{ item }}.j2"
+    dest: "/etc/apt/{{ item }}"
+  loop:
+    - sources.list.d/bullseye.list
+    - preferences.d/mtail-bullseye
+  when:
+    - ansible_distribution == "Debian"
+    - ansible_distribution_major_version | int <= 10
+    - ansible_distribution_release != "bullseye"
+
 - name: Install mtail
   apt:
     update_cache: true
@@ -17,6 +29,7 @@
   template:
     src: "mtail/{{ item }}.j2"
     dest: "/etc/mtail/{{ item }}"
+    mode: 0644
   loop:
     - dhcpd.mtail
     - radiusd.mtail
diff --git a/roles/mtail/templates/apt/preferences.d/mtail-bullseye.j2 b/roles/mtail/templates/apt/preferences.d/mtail-bullseye.j2
new file mode 100644
index 0000000000000000000000000000000000000000..9885d71d55a3bed3dd0af1faa9f3db34ab498468
--- /dev/null
+++ b/roles/mtail/templates/apt/preferences.d/mtail-bullseye.j2
@@ -0,0 +1,12 @@
+{{ ansible_header | comment }}
+
+
+Package: *
+Pin: release n=bullseye
+Pin-Priority: 1
+
+
+Package: mtail
+Pin: release n=bullseye
+Pin-Priority: 900
+
diff --git a/roles/mtail/templates/apt/sources.list.d/bullseye.list.j2 b/roles/mtail/templates/apt/sources.list.d/bullseye.list.j2
new file mode 100644
index 0000000000000000000000000000000000000000..e8bbe8d247ff27563951c1d55e30db2189fba97e
--- /dev/null
+++ b/roles/mtail/templates/apt/sources.list.d/bullseye.list.j2
@@ -0,0 +1,3 @@
+{{ ansible_header | comment }}
+
+deb http://{{ mirror.name }}/debian bullseye main
diff --git a/roles/mtail/templates/default/mtail.j2 b/roles/mtail/templates/default/mtail.j2
index 94bbac1aa55b8b6b725a832152c37ddd3515d54f..92523a8a56d50f6e1438dcccfc41fb38197c12f6 100644
--- a/roles/mtail/templates/default/mtail.j2
+++ b/roles/mtail/templates/default/mtail.j2
@@ -1,11 +1,6 @@
 {{ ansible_header | comment }}
-# Set to 1 to start Mtail at boot.
-ENABLED=1
-
-## Log processing.
-
 # List of files to monitor (mandatory).
-LOGS=/var/log/cablage/global.log
+LOGS=/var/log/daemon.log
 
 ## Metrics exporting.
 
@@ -25,4 +20,4 @@ LOGS=/var/log/cablage/global.log
 #METRIC_PUSH_INTERVAL=
 
 # Extra command-line arguments to pass to the server.
-EXTRA_ARGS=""
+#EXTRA_ARGS=""
diff --git a/roles/mtail/templates/mtail/dhcpd.mtail.j2 b/roles/mtail/templates/mtail/dhcpd.mtail.j2
index b3f8629b564458e79f00a6d28799fee6da0cd198..531dd4f1171ea52ef71fc8816951d95c47439a47 100644
--- a/roles/mtail/templates/mtail/dhcpd.mtail.j2
+++ b/roles/mtail/templates/mtail/dhcpd.mtail.j2
@@ -1,5 +1,5 @@
 {{ ansible_header | comment }}
-# Copyright 2011 Google Inc. All Rights Reserved.
+# Copyright 2008 Google Inc. All Rights Reserved.
 # This file is available under the Apache license.
 
 # Define the exported metric names.  The `by' keyword indicates the metric has
@@ -37,7 +37,7 @@ def syslog {
     }
     # If the RFC3339 style matched, parse it this way.
     len($rfc3339_date) > 0 {
-      strptime($rfc3339_date, "2006-01-02T15:04:05.999999999Z07:00")
+      strptime($rfc3339_date, "2006-01-02T03:04:05-0700")
     }
     # Call into the decorated block
     next
@@ -52,14 +52,14 @@ const MATCH_MAC /(?P<mac>([\da-f]{2}:){5}[\da-f]{2})/
     
 @syslog {
     # Request
-    /(balanced|balancing|BOOTREPLY|BOOTREQUEST|DHCPACK|DHCPDECLINE|DHCPDISCOVER|DHCPINFORM|DHCPNAK|DHCPOFFER|DHCPRELEASE|DHCPREQUEST)/ {
+    $message =~ /^(balanced|balancing|BOOTREPLY|BOOTREQUEST|DHCPACK|DHCPDECLINE|DHCPDISCOVER|DHCPINFORM|DHCPNAK|DHCPOFFER|DHCPRELEASE|DHCPREQUEST)/ {
         # The lowercased name of the command matched in the regex is used to
         # count the frequency of each command.  An external collector can use
         # this to compute the rate of each command independently.
         dhcpd_request_total[tolower($1)]++
 
         # DHCP Discover
-        /DHCPDISCOVER from / + MATCH_MAC {
+        $message =~ /^DHCPDISCOVER from / + MATCH_MAC {
             # Counts the discovery requests.
             dhcpd_dhcpdiscovers++
 
diff --git a/roles/mtail/templates/mtail/radiusd.mtail.j2 b/roles/mtail/templates/mtail/radiusd.mtail.j2
index c8fe6a81cc5f05d76417233e132aba7ee41f5678..e7b090f03b876115d20b8c01c9465579df08554b 100644
--- a/roles/mtail/templates/mtail/radiusd.mtail.j2
+++ b/roles/mtail/templates/mtail/radiusd.mtail.j2
@@ -21,19 +21,13 @@ def syslog {
     }
     # If the RFC3339 style matched, parse it this way.
     len($rfc3339_date) > 0 {
-      strptime($rfc3339_date, "2006-01-02T15:04:05.999999999Z07:00")
+      strptime($rfc3339_date, "2006-01-02T03:04:05-0700")
     }
     # Call into the decorated block
     next
   }
 }
 
-# Define some pattern constants for reuse in the patterns below.
-const IP /\d+(\.\d+){3}/
-const MATCH_IP /(?P<ip>/ + IP + /)/
-const MATCH_NETWORK /(?P<network>\d+(\.\d+){1,3}\/\d+)/
-const MATCH_MAC /(?P<mac>([\da-f]{2}:){5}[\da-f]{2})/
-
 @syslog {
     # Access ok!
     /Access ok/ {
diff --git a/roles/prometheus/templates/prometheus/prometheus.yml.j2 b/roles/prometheus/templates/prometheus/prometheus.yml.j2
index d99e0742a53bcab8e8eccfb3b362c00365bd2f68..7fe60352dc7d27d40dcf13aedc09430879fa2973 100644
--- a/roles/prometheus/templates/prometheus/prometheus.yml.j2
+++ b/roles/prometheus/templates/prometheus/prometheus.yml.j2
@@ -125,7 +125,7 @@ scrape_configs:
 
   - job_name: mtail
     static_configs:
-    - targets: ["thot.adm.crans.org"]
+    - targets: ["tealc.adm.crans.org"]
     relabel_configs:
       # Do not put :3903 in instance name, rather here
       - source_labels: [__address__]