Teleport#

Integration Details

Ingester

File Follower

Teleport Configuration#

For self-hosted clusters, Teleport defines its audit log location in teleport.yaml via the audit_events_uri parameter (for example, audit_events_uri: ['file:///var/lib/teleport/log']). Install File Follower on your Teleport host by following the instructions in File Follower. Then add the configuration from the File Follower section below.

Logs can also be exported using Fluentd. Follow the Teleport guide here: Export Audit Events: Fluentd, then follow the Gravwell Fluentd integration guide, with the following modifications:

Changes necessary to: /etc/fluent/fluentd.conf

  • <match **>: Change to match the pattern of your Teleport input

  • endpoint http://path.to.gravwell:port/fluentd: Change to endpoint http://path.to.gravwell:port/teleport

Changes necessary to: /opt/gravwell/etc/gravwell_http_ingester.conf.d/fluentd.conf

[Listener "teleport"]
    URL="/teleport"
    Tag-Name="teleport-audit"

Gravwell Configuration#

Gravwell Storage Well Configuration#

Set up the well configuration in your Gravwell indexers.

Sample well config:
Create or edit: /opt/gravwell/etc/gravwell.conf.d/teleport-well.conf

[Storage-Well "teleport"]
    Location=/opt/gravwell/storage/teleport
    Tags=teleport*

Gravwell Ingester Configuration: File Follower#

Sample File Follower config:
Create or edit: /opt/gravwell/etc/file_follow.conf.d/teleport.conf

[Follower "teleport"]
    Base-Directory = "/var/lib/teleport/log"
    File-Filter    = "*.log"
    Recursive      = true
    Tag-Name       = "teleport-audit"

Note

Remember to restart the service to apply the new config: sudo systemctl restart gravwell_file_follow.service