teleport icon indicating copy to clipboard operation
teleport copied to clipboard

Include source info for node/bot join fails

Open programmerq opened this issue 9 months ago • 0 comments

Expected behavior:

When viewing audit logs for instance join failures, the logs should include source address information to determine where the join attempts are originating from. In a scenario where an unknown script or process is the offending client, these log messages should have some information about the remote IP, or any other identifying information. Without that, these logs aren't actionable and can be excessively noisy.

Current behavior:

The audit logs flood with "Instance Join Failed" messages without providing any helpful information such as the source address of the attempt. This makes it challenging to diagnose issues or identify the origin of failed join attempts.

This audit event was introduced in #40329 / v15.2.4

Bug details:

  • Teleport version: 15.3.0 (Original report was from a Teleport Cloud user, but self-hosted is affected as well)
  • Recreation steps:
    1. Observe an "Instance Join Failed" message in the audit log.
    2. Notice the absence of source address information in the log entry.
  • Debug logs:
{
  "event": "instance.join",
  "success": false,
  "time": "2024-05-10T16:05:44.933Z",
  "cluster_name": "example.teleort.sh",
  "token_expires": "0001-01-01T00:00:00Z",
  "uid": "fcd67e48-fc3e-4faf-9dbf-1a5b7edb299c",
  "error": "rpc error: code = Canceled desc = context canceled",
  "code": "TJ002E",
  "ei": 0
}

The lack of source address information in "Instance Join Failed" messages impedes troubleshooting efforts for Teleport administrators. It is valuable to include such details to facilitate better incident analysis and response.

programmerq avatar May 10 '24 17:05 programmerq