Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Include source info for node/bot join fails #41421

Closed
programmerq opened this issue May 10, 2024 · 0 comments · Fixed by #41452
Closed

Include source info for node/bot join fails #41421

programmerq opened this issue May 10, 2024 · 0 comments · Fixed by #41452
Labels
audit-log Issues related to Teleports Audit Log bug c-tt Internal Customer Reference

Comments

@programmerq
Copy link
Contributor

Expected behavior:

When viewing audit logs for instance join failures, the logs should include source address information to determine where the join attempts are originating from. In a scenario where an unknown script or process is the offending client, these log messages should have some information about the remote IP, or any other identifying information. Without that, these logs aren't actionable and can be excessively noisy.

Current behavior:

The audit logs flood with "Instance Join Failed" messages without providing any helpful information such as the source address of the attempt. This makes it challenging to diagnose issues or identify the origin of failed join attempts.

This audit event was introduced in #40329 / v15.2.4

Bug details:

  • Teleport version: 15.3.0 (Original report was from a Teleport Cloud user, but self-hosted is affected as well)
  • Recreation steps:
    1. Observe an "Instance Join Failed" message in the audit log.
    2. Notice the absence of source address information in the log entry.
  • Debug logs:
{
  "event": "instance.join",
  "success": false,
  "time": "2024-05-10T16:05:44.933Z",
  "cluster_name": "example.teleort.sh",
  "token_expires": "0001-01-01T00:00:00Z",
  "uid": "fcd67e48-fc3e-4faf-9dbf-1a5b7edb299c",
  "error": "rpc error: code = Canceled desc = context canceled",
  "code": "TJ002E",
  "ei": 0
}

The lack of source address information in "Instance Join Failed" messages impedes troubleshooting efforts for Teleport administrators. It is valuable to include such details to facilitate better incident analysis and response.

@programmerq programmerq added bug audit-log Issues related to Teleports Audit Log c-tt Internal Customer Reference labels May 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
audit-log Issues related to Teleports Audit Log bug c-tt Internal Customer Reference
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant