Audit Event Reference
Teleport components emit audit events to record activity within the cluster.
Audit event payloads have an event field that describes the event, which is
often an operation performed against a dynamic resource (e.g.,
access_list.create for the creation of an Access List) or some other user
behavior, such as a local user login (user.login). The code field
includes a string with pattern [A-Z0-9]{6} that is unique to an audit event,
such as TAP03I for the creation of an application resource.
In some cases, an audit event describes both a success state and a failure
state, while the event field is the same for both states. In this case, the
code field differs between states. For example, access_list.create
describes both successful and failed Access List creations, while the success
event has code TAL001I and the failure has code TAL001E. For other
events, like db.session.query.failed and db.session.query, the event
type describes only the success or failure state.
You can set up Teleport to export audit events to third-party services for storage, visualization, and analysis. For more information, read Exporting Teleport Audit Events.