{"token_count": 1468}

# Auto Discovery Audit Events

This page lists audit events related to automatically discovering and enrolling Teleport resources.

## azure.run

There are multiple events with the `azure.run` type.

### TDA00I

Azure Run Command Executed

Example:

```
{
  "cluster_name": "example.teleport.sh",
  "code": "TDA00I",
  "ei": 0,
  "event": "azure.run",
  "subscription_id": "00000000-0000-0000-0000-000000000000",
  "resource_group": "example-dev-a1b2c3d4-workload-rg",
  "vm_id": "11111111-1111-1111-1111-111111111111",
  "vm_name": "example-dev-a1b2c3d4-vm-0",
  "resource_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-0",
  "region": "eastus",
  "exit_code": 0,
  "execution_state": "Succeeded",
  "stdout": "teleport has been installed successfully",
  "stderr": "",
  "status": "Installation completed successfully.",
  "time": "2026-04-01T00:00:00.000Z",
  "uid": "11111111-1111-1111-1111-111111111110"
}

```

### TDA00W

Azure Run Command Failed

Example:

```
{
  "cluster_name": "example.teleport.sh",
  "code": "TDA00W",
  "ei": 0,
  "event": "azure.run",
  "api_error": "PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-1/runCommands/teleport-install: 403 Forbidden: AuthorizationFailed: The client does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommands/write' over scope.",
  "subscription_id": "00000000-0000-0000-0000-000000000000",
  "resource_group": "example-dev-a1b2c3d4-workload-rg",
  "vm_id": "22222222-2222-2222-2222-222222222222",
  "vm_name": "example-dev-a1b2c3d4-vm-1",
  "resource_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-1",
  "region": "eastus",
  "exit_code": 0,
  "execution_state": "",
  "stdout": "",
  "stderr": "",
  "status": "API call failed",
  "time": "2026-04-01T00:00:01.000Z",
  "uid": "22222222-2222-2222-2222-222222222220"
}

```

## discovery\_config.create

Discovery Config Created

Example:

```
{
  "code": "DC001I",
  "event": "discovery_config.create",
  "time": "2023-05-08T19:21:36.144Z",
  "name": "discovery-config",
  "updated_by": "joe"
}

```

## discovery\_config.delete

Discovery Config Deleted

Example:

```
{
  "code": "DC003I",
  "event": "discovery_config.delete",
  "time": "2023-05-08T19:21:38.144Z",
  "name": "discovery-config",
  "updated_by": "joe"
}

```

## discovery\_config.delete\_all

All Discovery Configs Deleted

Example:

```
{
  "code": "DC004I",
  "event": "discovery_config.delete_all",
  "time": "2023-05-08T19:21:39.144Z",
  "name": "discovery-config",
  "updated_by": "joe"
}

```

## discovery\_config.update

Discovery Config Updated

Example:

```
{
  "code": "DC002I",
  "event": "discovery_config.update",
  "time": "2023-05-08T19:21:37.144Z",
  "name": "discovery-config",
  "updated_by": "joe"
}

```

## ssm.run

There are multiple events with the `ssm.run` type.

### TDS00I

SSM Command Executed

Example:

```
{
  "account_id": "278576220453",
  "cluster_name": "localhost",
  "code": "TDS00I",
  "command_id": "e8a5f3ba-e9e5-4cbd-979b-18fd1e7ad00f",
  "ei": 0,
  "event": "ssm.run",
  "exit_code": 0,
  "instance_id": "i-057d0ffe877128673",
  "platform_name": "Amazon Linux",
  "platform_type": "Linux",
  "platform_version": "2023.5.20240916",
  "region": "eu-central-1",
  "status": "Success",
  "time": "2022-09-14T14:45:38.122Z",
  "uid": "d053a9a4-6362-4d46-8868-55d83b7b338f"
}

```

### TDS00W

SSM Command Execution Failed

Example:

```
{
  "account_id": "278576220453",
  "cluster_name": "localhost",
  "code": "TDS00W",
  "command_id": "c2936d68-fc0c-4c16-a860-916a97f57644",
  "ei": 0,
  "event": "ssm.run",
  "exit_code": 1,
  "instance_id": "i-057d0ffe877128673",
  "platform_name": "Amazon Linux",
  "platform_type": "Linux",
  "platform_version": "2023.5.20240916",
  "region": "eu-central-1",
  "status": "Failure",
  "time": "2022-09-14T14:45:38.122Z",
  "uid": "ad123558-1d20-42dd-bf82-a7c544d76550"
}

```