Usage report event (T2006I) is missing session ID

[webvictim]

Expected behavior

session.data events should display their associated ID correctly in the web UI's audit events view.

Current behavior

session.data events have a missing UUID/ID in the audit events view:

The root cause appears to be a missing sid in the events themselves.

Event payloads:

{
  "addr.remote": "1.2.3.4:56901",
  "cluster_name": "purple",
  "code": "T2006I",
  "ei": 2147483646,
  "event": "session.data",
  "login": "ec2-user",
  "namespace": "default",
  "private_key_policy": "none",
  "rx": 68204334,
  "server_hostname": "ip-172-31-34-60.us-east-2.compute.internal",
  "server_id": "b358023d-2c0b-424c-b837-1f680d21e1f4",
  "sid": "",
  "time": "2024-05-17T18:12:03.653Z",
  "tx": 202256,
  "uid": "4379444b-b60d-4983-8e13-01705106557e",
  "user": "webvictim",
  "user_kind": 1
}

{
  "addr.remote": "1.2.3.4:56352",
  "cluster_name": "purple",
  "code": "T2006I",
  "ei": 2147483646,
  "event": "session.data",
  "login": "ec2-user",
  "namespace": "default",
  "private_key_policy": "none",
  "rx": 294774,
  "server_hostname": "ip-172-31-34-60.us-east-2.compute.internal",
  "server_id": "b358023d-2c0b-424c-b837-1f680d21e1f4",
  "sid": "",
  "time": "2024-05-17T18:06:33.845Z",
  "tx": 68505128,
  "uid": "4a2b0d01-adef-437b-b3f8-7fe36d66b7ba",
  "user": "webvictim",
  "user_kind": 1
}

Bug details:

• Teleport version: 15.3.5

[zmb3]

Looks like these are SSH sessions, not Kube. Correct?

Are they interactive or non-interactive? Is there a PTY attached?

[webvictim]

I think they're related to SFTP actions. The one with the larger rx value is a download, the other is an upload. There was an interactive session open at the time (I did this via the browser)