From c841f2e8dd10b156d3e8b56e490fe095ce29800b Mon Sep 17 00:00:00 2001
From: Jane Quintero <quinq@gravitational.com>
Date: Thu, 18 Feb 2021 05:51:43 -0800
Subject: [PATCH] add test for exec events

---
 integration/integration_test.go | 51 +++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/integration/integration_test.go b/integration/integration_test.go
index 7d3dc574526..93ab140654d 100644
--- a/integration/integration_test.go
+++ b/integration/integration_test.go
@@ -4832,6 +4832,57 @@ func (s *IntSuite) TestBPFSessionDifferentiation(c *check.C) {
 	c.Fatalf("Failed to find command events from two different sessions.")
 }
 
+// TestExecEvents tests if exec events were emitted with and without PTY allocated
+func (s *IntSuite) TestExecEvents(c *check.C) {
+	s.setUpTest(c)
+	defer s.tearDownTest(c)
+	tr := utils.NewTracer(utils.ThisFunction()).Start()
+	defer tr.Stop()
+
+	lsPath, err := exec.LookPath("ls")
+	c.Assert(err, check.IsNil)
+
+	// Creates new teleport cluster
+	main := s.newTeleport(c, nil, true)
+	defer main.StopAll()
+
+	var execTests = []struct {
+		name          string
+		isInteractive bool
+		outCommand    string
+	}{
+		{
+			name:          "Exec event when PTY is allocated",
+			isInteractive: true,
+			outCommand:    lsPath,
+		},
+		{
+			name:          "Exec event when PTY is NOT allocated",
+			isInteractive: false,
+			outCommand:    lsPath,
+		},
+	}
+
+	for _, tt := range execTests {
+		// Create client for each test in grid tests
+		clientConfig := ClientConfig{
+			Login:       s.me.Username,
+			Cluster:     Site,
+			Host:        Host,
+			Port:        main.GetPortSSHInt(),
+			Interactive: tt.isInteractive,
+		}
+		name := check.Commentf(tt.name)
+		_, err := runCommand(main, []string{lsPath}, clientConfig, 1)
+		c.Assert(err, check.IsNil, name)
+		// Make sure the exec event was emitted to the audit log.
+		eventFields, err := findEventInLog(main, events.ExecEvent)
+		c.Assert(err, check.IsNil, name)
+		c.Assert(eventFields.GetCode(), check.Equals, events.ExecCode, name)
+		c.Assert(eventFields.GetString(events.ExecEventCommand), check.Equals, tt.outCommand, name)
+	}
+}
+
 // findEventInLog polls the event log looking for an event of a particular type.
 func findEventInLog(t *TeleInstance, eventName string) (events.EventFields, error) {
 	for i := 0; i < 10; i++ {