EventFromChunk returns event converted from session chunk.

Creates and returns a new Audit Log object whish will store its logfiles in a given directory.

NewDiscardAuditLog returns a no-op audit log instance.

NewDiskSessionLogger creates new disk based session logger.

NewFileLog returns a new instance of a file log.

NewForwarder returns a new instance of session forwarder.

NewForwardRecorder returns a new instance of session recorder.

NewMultiLog returns a new instance of a multi logger.

NewSessionArchive returns generated tar archive with all components.

NewUploader creates new disk based session logger.

UpdateEventFields updates passed event fields with additional information common for all event types such as unique IDs, timestamps, codes, etc.

ValidateArchive validates namespace and serverID fields within all events in the archive.

ValidateEvent checks the the fields within an event match the passed in expected values.

AuthAttemptEvent is authentication attempt that either succeeded or failed based on event status.

ClientDisconnectEvent is emitted when client is disconnected by the server due to inactivity or any other reason.

EventCode is a code that uniquely identifies a particular event type.

EventCursor is an event ID (used as cursor value for enumeration, not stored).

EventID is a unique event identifier.

EventIndex is an event index as received from the logging server.

EventLogin is OS login.

EventNamespace is a namespace of the session event.

EventProtocol specifies protocol that was captured.

EventProtocolKube specifies kubernetes as a type of captured protocol.

EventProtocolsSSH specifies SSH as a type of captured protocol.

EventTime is event time.

EventType is event type/kind.

EventUser is teleport user name.

ExecEvent is an exec command executed by script or user on the server side.

LocalAddr is a target address on the host.

LogfileExt defines the ending of the daily event log file.

LoginMethod is the event field indicating how the login was performed.

LoginMethodGithub represents login with Github.

LoginMethodLocal represents login with username/password.

LoginMethodOIDC represents login with OIDC.

LoginMethodSAML represents login with SAML.

MaxChunkBytes defines the maximum size of a session stream chunk that can be requested via AuditLog.GetSessionChunk().

PlaybacksDir is a directory for playbacks.

Port forwarding event.

Reason is a field that specifies reason for event, e.g.

RemoteAddr is a client (user's) address.

ResizeEvent means that some user resized PTY on the client.

SCPEvent means data transfer that occurred on the server.

SessionByteOffset is the number of bytes written to session stream since the beginning.

SessionEndEvent indicates that a session has ended.

SessionEventTimestamp is an offset (in milliseconds) since the beginning of the session when the terminal IO event happened.

SessionJoinEvent indicates that someone joined a session.

SessionLeaveEvent indicates that someone left a session.

SessionLogsDir is a subdirectory inside the eventlog data dir where all session-specific logs and streams are stored, like in /var/lib/teleport/logs/sessions.

SessionPrintEvent event happens every time a write occurs to temirnal I/O during a session.

SessionPrintEventBytes says how many bytes have been written into the session during "print" event.

SessionEvent indicates that session has been initiated or updated by a joining party on the server.

SessionUploadEvent indicates that session has been uploaded to the external storage.

SubsystemEvent is the result of the execution of a subsystem.

SymlinkFilename is a name of the symlink pointing to the last current log file.

expressed as 'W:H'.

URL is used for a session upload URL.

UserLoginEvent indicates that a user logged into web UI or via tsh.

V1 is the V1 version of slice chunks API, it is 0 because it was not defined before.

V2 is the V2 version of slice chunks API.

V3 is almost like V2, but it assumes that session recordings are being uploaded at the end of the session, so it skips writing session event index on the fly.

AuthAttemptFailure is emitted upon a failed authentication attempt.

AuthAttemptFailureCode is the auth attempt failure event code.

ClientDisconnect is emitted when a user session is disconnected.

ClientDisconnectCode is the client disconnect event code.

Exec is emitted when a user executes a command on a node.

ExecCode is the exec event code.

ExecFailure is emitted when a user command execution fails.

ExecFailureCode is the exec failure event code.

PortForward is emitted when a user requests port forwarding.

PortForwardCode is the port forward event code.

PortForwardFailure is emitted when a port forward request fails.

PortForwardFailureCode is the port forward failure event code.

SCPDownload is emitted when a user downloads a file.

SCPDownloadCode is the file download event code.

SCPDownloadFailure is emitted when a file download fails.

SCPDownloadFailureCode is the file download event failure code.

SCPUpload is emitted when a user uploads a file.

SCPUploadCode is the file upload event code.

SCPUploadFailure is emitted when a file upload fails.

SCPUploadFailureCode is the file upload failure event code.

SessionEnd is emitted when a user ends the session.

SessionEndCode is the session end event code.

SessionJoin is emitted when a user joins the session.

SessionJoinCode is the session join event code.

SessionLeave is emitted when a user leaves the session.

SessionLeaveCode is the session leave event code.

SessionStart is emitted when a user starts a new session.

SessionStartCode is the session start event code.

SessionUpload is emitted after a session recording has been uploaded.

SessionUploadCode is the session upload event code.

Subsystem is emitted when a user requests a new subsystem.

SubsystemCode is the subsystem event code.

SubsystemFailure is emitted when a user subsystem request fails.

SubsystemFailureCode is the subsystem failure event code.

TerminalResize is emitted when a user resizes the terminal.

TerminalResizeCode is the terminal resize event code.

UserLocalLogin is emitted when a local user successfully logs in.

UserLocalLoginCode is the successful local user login event code.

UserLocalLoginFailure is emitted when a local user login attempt fails.

UserLocalLoginFailureCode is the unsuccessful local user login event code.

UserSSOLogin is emitted when an SSO user successfully logs in.

UserSSOLoginCode is the successful SSO user login event code.

UserSSOLoginFailure is emitted when an SSO user login attempt fails.

UserSSOLoginFailureCode is the unsuccessful SSO user login event code.

AuditLog is a new combined facility to record Teleport events and sessions.

AuditLogConfig specifies configuration for AuditLog server.

AuditLogEvent is an internal audit log event.

DiscardAuditLog is do-nothing, discard-everything implementation of IAuditLog interface used for cases when audit is turned off.

DiscardRecorder discards all writes.

DiskSessionLogger implements a disk based session logger.

DiskSessionLoggerConfig sets up parameters for disk session logger associated with the session ID.

Event describes an audit log event.

FileLog is a file local audit events log, logs all events to the local file in json encoded form.

FileLogConfig is a configuration for file log.

ForwarderConfig forwards session log events to the auth server, and writes the session playback to disk.

ForwarderConfig forwards session log events to the auth server, and writes the session playback to disk.

ForwardRecorder implements io.Writer to be plugged into the multi-writer associated with every session.

ForwardRecorderConfig specifies config for session recording.

MockAuditLog is audit log used for tests.

MultiLog is a logger that fan outs write operations to all loggers, and performs all read and search operations on the first logger that implements the operation.

SessionChunk is a chunk to be posted in the context of the session.

SessionRecording is a recording of a live session.

SessionSlice is a slice of submitted chunks.

Uploader implements a disk based session logger.

UploaderConfig sets up configuration for uploader service.

UploadEvent is emitted by uploader and is used in tests.

IAuditLog is the primary (and the only external-facing) interface for AuditLogger.

sessionLogger is an interface that all session loggers must implement.

SessionRecorder implements io.Writer to be plugged into the multi-writer associated with every session.

UploadHandler is a function supplied by the user, it will upload the file.

ByTimeAndIndex sorts events by time extracting timestamp from JSON field and if there are several session events with the same session by event index, regardless of the time.

EventFields instance is attached to every logged event.