Auto Discovery Audit Events
This page lists audit events related to automatically discovering and enrolling Teleport resources.
azure.run
There are multiple events with the azure.run type.
TDA00I
Azure Run Command Executed
Example:
{
"cluster_name": "example.teleport.sh",
"code": "TDA00I",
"ei": 0,
"event": "azure.run",
"subscription_id": "00000000-0000-0000-0000-000000000000",
"resource_group": "example-dev-a1b2c3d4-workload-rg",
"vm_id": "11111111-1111-1111-1111-111111111111",
"vm_name": "example-dev-a1b2c3d4-vm-0",
"resource_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-0",
"region": "eastus",
"exit_code": 0,
"execution_state": "Succeeded",
"stdout": "teleport has been installed successfully",
"stderr": "",
"status": "Installation completed successfully.",
"time": "2026-04-01T00:00:00.000Z",
"uid": "11111111-1111-1111-1111-111111111110"
}
TDA00W
Azure Run Command Failed
Example:
{
"cluster_name": "example.teleport.sh",
"code": "TDA00W",
"ei": 0,
"event": "azure.run",
"api_error": "PUT https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-1/runCommands/teleport-install: 403 Forbidden: AuthorizationFailed: The client does not have authorization to perform action 'Microsoft.Compute/virtualMachines/runCommands/write' over scope.",
"subscription_id": "00000000-0000-0000-0000-000000000000",
"resource_group": "example-dev-a1b2c3d4-workload-rg",
"vm_id": "22222222-2222-2222-2222-222222222222",
"vm_name": "example-dev-a1b2c3d4-vm-1",
"resource_id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-dev-a1b2c3d4-workload-rg/providers/Microsoft.Compute/virtualMachines/example-dev-a1b2c3d4-vm-1",
"region": "eastus",
"exit_code": 0,
"execution_state": "",
"stdout": "",
"stderr": "",
"status": "API call failed",
"time": "2026-04-01T00:00:01.000Z",
"uid": "22222222-2222-2222-2222-222222222220"
}
discovery_config.create
Discovery Config Created
Example:
{
"code": "DC001I",
"event": "discovery_config.create",
"time": "2023-05-08T19:21:36.144Z",
"name": "discovery-config",
"updated_by": "joe"
}
discovery_config.delete
Discovery Config Deleted
Example:
{
"code": "DC003I",
"event": "discovery_config.delete",
"time": "2023-05-08T19:21:38.144Z",
"name": "discovery-config",
"updated_by": "joe"
}
discovery_config.delete_all
All Discovery Configs Deleted
Example:
{
"code": "DC004I",
"event": "discovery_config.delete_all",
"time": "2023-05-08T19:21:39.144Z",
"name": "discovery-config",
"updated_by": "joe"
}
discovery_config.update
Discovery Config Updated
Example:
{
"code": "DC002I",
"event": "discovery_config.update",
"time": "2023-05-08T19:21:37.144Z",
"name": "discovery-config",
"updated_by": "joe"
}
ssm.run
There are multiple events with the ssm.run type.
TDS00I
SSM Command Executed
Example:
{
"account_id": "278576220453",
"cluster_name": "localhost",
"code": "TDS00I",
"command_id": "e8a5f3ba-e9e5-4cbd-979b-18fd1e7ad00f",
"ei": 0,
"event": "ssm.run",
"exit_code": 0,
"instance_id": "i-057d0ffe877128673",
"platform_name": "Amazon Linux",
"platform_type": "Linux",
"platform_version": "2023.5.20240916",
"region": "eu-central-1",
"status": "Success",
"time": "2022-09-14T14:45:38.122Z",
"uid": "d053a9a4-6362-4d46-8868-55d83b7b338f"
}
TDS00W
SSM Command Execution Failed
Example:
{
"account_id": "278576220453",
"cluster_name": "localhost",
"code": "TDS00W",
"command_id": "c2936d68-fc0c-4c16-a860-916a97f57644",
"ei": 0,
"event": "ssm.run",
"exit_code": 1,
"instance_id": "i-057d0ffe877128673",
"platform_name": "Amazon Linux",
"platform_type": "Linux",
"platform_version": "2023.5.20240916",
"region": "eu-central-1",
"status": "Failure",
"time": "2022-09-14T14:45:38.122Z",
"uid": "ad123558-1d20-42dd-bf82-a7c544d76550"
}
Was this page helpful?