No More Backdoors: Know Who Has Access to What, Right Now
Jun 13
Register Today
Teleport logoTry For Free
Fork me on GitHub



Teleport leverages Go's diagnostic capabilities to collect and export profiling data. Profiles can help identify the cause of spikes in CPU, the source of memory leaks, or the reason for a deadlock.

Using the Debug Service

The Teleport Debug Service enables administrators to collect diagnostic profiles without enabling pprof endpoints at startup. The service, enabled by default, ensures local-only access and must be consumed from inside the same instance.

teleport debug profile collects a list of pprof profiles. It outputs a compressed tarball (.tar.gz) to STDOUT. You decompress it using tar or direct the result to a file.

By default, it collects goroutine, heap and profile profiles.

Each profile collected will have a correspondent file inside the tarball. For example, collecting goroutine,trace,heap will result in goroutine.pprof, trace.pprof, and heap.pprof files.

Collect default profiles and save to a file.

teleport debug profile > pprof.tar.gz
tar xvf pprof.tar.gz

Collect default profiles and decompress it.

teleport debug profile | tar xzv -C ./

Collect "trace" and "mutex" profiles and save to a file.

teleport debug profile trace,mutex > pprof.tar.gz

Collect profiles setting the profiling time in seconds

teleport debug profile -s 20 trace > pprof.tar.gz
Specify your Teleport configuration path

If your Teleport configuration is not placed on the default path (/var/lib/teleport), you must to specify its location to the CLI command using the -c/--config flag.

If you're running Teleport on a Kubernetes cluster you can directly collect profiles to a local directory without an interactive session:

kubectl -n teleport exec my-pod -- teleport debug profile > pprof.tar.gz

After extracting the contents, you can use go tool commands to explore and visualize them:

Opens the terminal interactive explorer

go tool pprof heap.pprof

Opens the web visualizer

go tool pprof -http : heap.pprof

Visualize trace profiles

go tool trace trace.pprof

Using diagnostics endpoints

The profiling endpoint is only enabled if the --debug flag is supplied.

Teleport's diagnostic HTTP endpoints are disabled by default. You can enable them via:

Start a teleport instance with the --diag-addr flag set to the local address where the diagnostic endpoint will listen:

sudo teleport start --debug --diag-addr=

Edit a teleport instance's configuration file (/etc/teleport.yaml by default) to include the following:


To enable debug logs:

    severity: DEBUG

Verify that Teleport is now serving the diagnostics endpoint:


Collecting profiles

Go's standard profiling endpoints are served at Retrieving a profile requires sending a request to the endpoint corresponding to the desired profile type. When debugging an issue it is helpful to collect a series of profiles over a period of time.


CPU profile shows execution statistics gathered over a user specified period:

Download the profile into a file:

curl -o cpu.profile

Visualize the profile

go tool pprof -http : cpu.profile


Goroutine profiles show the stack traces for all running goroutines in the system:

Download the profile into a file:

curl -o goroutine.profile

Visualize the profile

go tool pprof -http : goroutine.profile


Heap profiles show allocated objects in the system:

Download the profile into a file:

curl -o heap.profile

Visualize the profile

go tool pprof -http : heap.profile


Trace profiles capture scheduling, system calls, garbage collections, heap size, and other events that are collected by the Go runtime over a user specified period of time:

Download the profile into a file:

curl -o trace.out

Visualize the profile

go tool trace trace.out

Further Reading