Applications Audit Events
This page lists audit events related to Teleport-protected applications.
app.create
Application Created
Example:
{
"code": "TAP03I",
"ei": 0,
"event": "app.create",
"time": "2022-09-27T19:07:35.00Z",
"uid": "45cabf1e-3f19-4f83-a360-01ac0a176b67",
"aws_role_arn": "arn:aws:iam::1234567890:role/steve",
"name": "dynamic-app",
"user": "mike"
}
app.delete
Application Deleted
Example:
{
"code": "TAP05I",
"ei": 0,
"event": "app.delete",
"time": "2022-09-27T19:11:35.00Z",
"uid": "d2342a20-9697-4a5d-9658-5d473e04624a",
"aws_role_arn": "arn:aws:iam::1234567890:role/steve",
"name": "dynamic-app",
"user": "mike"
}
app.session.chunk
App Session Data
Example:
{
"code": "T2008I",
"ei": 0,
"event": "app.session.chunk",
"namespace": "default",
"server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
"session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
"sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
"time": "2020-10-30T17:28:14.705Z",
"uid": "8ea5be3d-07b1-4308-8e0d-2d2ec57cbb20",
"user": "alice",
"app_name": "test"
}
app.session.dynamodb.request
App Session DynamoDB Request
Example:
{
"code": "T2013I",
"ei": 1,
"event": "app.session.dynamodb.request",
"app_name": "dyno1",
"app_public_addr": "dynamodb.root.com",
"app_uri": "https://console.aws.amazon.com/dynamodbv2/home",
"aws_host": "dynamodb.us-west-2.amazonaws.com",
"aws_region": "us-west-2",
"aws_role_arn": "arn:aws:iam::123456789012:role/GavinDynamoDBRole",
"aws_service": "dynamodb",
"body": {
"TableName": "test-table"
},
"cluster_name": "root.com",
"method": "POST",
"path": "/",
"raw_query": "",
"session_chunk_id": "3a54f32d-210f-4338-abf5-133bfe19ccc0",
"status_code": 200,
"target": "DynamoDB_20120810.Scan",
"time": "2022-10-19T19:04:07.763Z",
"uid": "f6f38f69-46e9-4110-a773-2c88278d08ca",
"user": "alice"
}
app.session.end
App Session Ended
Example:
{
"app_name": "ponger",
"app_public_addr": "ponger.root.gravitational.io",
"app_uri": "tcp://localhost:9876",
"cluster_name": "root",
"code": "T2011I",
"ei": 0,
"event": "app.session.end",
"namespace": "default",
"server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
"sid": "11c328b4-5a1e-4adc-b7cb-206389e5f130",
"time": "2022-08-10T19:54:40.444Z",
"uid": "ac8c9b6b-46a0-4b0e-8d85-2204101d5615",
"user": "alice"
}
app.session.request.denied
App Request Denied
Example:
{
"addr.remote": "127.0.0.1:41106",
"app_name": "dev-app",
"app_public_addr": "dev-app.root.gravitational.io",
"app_session_id": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
"app_uri": "http://localhost:8080",
"cluster_name": "root",
"code": "T2020E",
"deny_kind": "teleport_request_not_allowed",
"ei": 0,
"event": "app.session.request.denied",
"method": "GET",
"namespace": "default",
"path": "/api/things",
"server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
"server_version": "19.0.0",
"time": "2022-08-10T19:54:41.444Z",
"uid": "e0b0e0f4-6b1a-4b6e-9f3f-2a4f9a1d6c11",
"user": "alice"
}
app.session.start
There are multiple events with the app.session.start type.
T2007I
App Session Started
Example:
{
"addr.remote": "50.34.48.113:56902",
"code": "T2007I",
"ei": 0,
"event": "app.session.start",
"namespace": "default",
"public_addr": "dumper.test.domain.com",
"server_id": "a0518380-0d53-4188-ac8b-8ddd8103e45b",
"sid": "6593cf87-9839-4f18-abf8-c54873aaeb4e",
"time": "2020-10-30T17:28:14.381Z",
"uid": "80400ed9-644e-4a6e-ab99-b264b34d0f55",
"user": "kimlisa",
"app_name": "test"
}
T2007E
App Session Start Failed
Example:
{
"code": "T2007E",
"event": "app.session.start",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
app.session.target.dial.denied
App Target Dial Denied
Example:
{
"app_name": "internal-app",
"app_public_addr": "internal-app.root.gravitational.io",
"app_uri": "http://metadata.internal",
"blocked_ip": "169.254.169.254",
"blocked_prefix": "169.254.0.0/16",
"cluster_name": "root",
"code": "T2019E",
"ei": 0,
"event": "app.session.target.dial.denied",
"namespace": "default",
"policy": "denied_hosts",
"resolved_ips": [
"169.254.169.254"
],
"server_id": "8e70002c-7a07-4513-a3fa-ac556a1d7534",
"sid": "11c328b4-5a1e-4adc-b7cb-206389e5f130",
"target_host": "metadata.internal",
"target_port": "80",
"time": "2022-08-10T19:54:41.444Z",
"uid": "bc1fbf7e-b739-4ea3-8bb9-cf1e79c8acb5",
"user": "alice"
}
app.update
Application Updated
Example:
{
"code": "TAP04I",
"ei": 0,
"event": "app.update",
"time": "2022-09-27T19:09:35.00Z",
"uid": "9909a8d6-b45f-455c-953d-ba1a62340810",
"aws_role_arn": "arn:aws:iam::1234567890:role/steve",
"name": "dynamic-app",
"user": "mike"
}
git.command
There are multiple events with the git.command type.
TGIT001E
Git Command Failed
Example:
{
"code": "TGIT001E",
"event": "git.command",
"time": "2024-12-07T11:11:11.111Z",
"uid": "7699b806-e717-4821-85a5-d2f41acbe373",
"user": "Linus.Torvalds",
"service": "git-upload-pack",
"exitError": "some-error",
"path": "my-org/my-repo"
}
TGIT001I
Git Command
Example:
{
"code": "TGIT001I",
"event": "git.command",
"time": "2024-12-07T11:11:11.112Z",
"uid": "7699b806-e717-4821-85a5-d2f41acbe373",
"user": "Linus.Torvalds",
"service": "git-upload-pack",
"path": "my-org/my-repo"
}
http.request
App HTTP Request
Example:
{
"code": "T2015I",
"event": "http.request",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
http.request.body_chunk
App HTTP Request Body
Example:
{
"code": "T2016I",
"event": "http.request.body_chunk",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
http.response
App HTTP Response
Example:
{
"code": "T2017I",
"event": "http.response",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
http.response.body_chunk
App HTTP Response Body
Example:
{
"code": "T2018I",
"event": "http.response.body_chunk",
"time": "2020-06-05T16:24:05Z",
"uid": "68a83a99-73ce-4bd7-bbf7-99103c2ba6a0"
}
vnet.config.create
VNet config created
Example:
{
"addr.remote": "127.0.0.1:62460",
"cluster_name": "teleport.dev",
"code": "TVNET001I",
"ei": 0,
"event": "vnet.config.create",
"success": true,
"time": "2025-03-04T15:49:21.869Z",
"uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
"user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
"user_cluster_name": "teleport.dev",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
vnet.config.delete
VNet config deleted
Example:
{
"addr.remote": "127.0.0.1:62460",
"cluster_name": "teleport.dev",
"code": "TVNET003I",
"ei": 0,
"event": "vnet.config.delete",
"success": true,
"time": "2025-03-04T15:49:21.869Z",
"uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
"user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
"user_cluster_name": "teleport.dev",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
vnet.config.update
VNet config updated
Example:
{
"addr.remote": "127.0.0.1:62460",
"cluster_name": "teleport.dev",
"code": "TVNET002I",
"ei": 0,
"event": "vnet.config.update",
"success": true,
"time": "2025-03-04T15:49:21.869Z",
"uid": "e1973df2-4bee-4a67-9925-575c1d38cc80",
"user": "08fcd522-edcb-492d-8752-90494a28b70e.teleport.dev",
"user_cluster_name": "teleport.dev",
"user_kind": 3,
"user_roles": [
"Admin"
]
}
Was this page helpful?