Skip to content

Tie session recordings to session.upload event rather than session.end event #11599

Open

Description

Issue

Currently, we find session upload by searching through the audit log for session.end events, and then attempting to find its associated session recording.

This leads to a few issues:

  • If a session does not have a session recording, it will still show up in the webui. Clicking on it will give a Recording not available message.
    • This can happen if session recording is disabled, or the session recording is otherwise not present.
    • Sometimes additional session.end events are emitted, leading to duplicate recordings Duplicate Session Recordings #11595
  • Abanonded sessions (due to server restart, failure, etc) do not have a session.end event. When we upload the abandoned session upload on the next server start, we have to emit a fake session.end event so that the recording is available. This extra logic has grown more convoluted overtime and will lead to more bugs. A couple issues currently exist:
    • If the session upload completes but the session.end event is not emitted, we run into issue the first issue.
    • If the session has 0 multiplart uploads (the session is short), then the session end event is never emitted. it only takes a moment to run sudo rm -rf / :)

Solution

Instead, we should use the session.upload event, which should always be emitted alongside the session upload itself, leaving little to no room for these same issues. Any information that we need to grab from the session.end event can be added to the session.upload event instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Labels

    audit-logIssues related to Teleports Audit Logfeature-requestUsed for new features in Teleport, improvements to current should be #enhancements

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions