Detections
Analytics

2.13 Ensure centralized and remote logging is configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Docker supports various logging mechanisms. A preferable method for storing logs is one that supports centralized and remote management.

Rationale:

Centralized and remote logging ensures that all important log records are safe even in the event of a major data availability issue . Docker supports various logging methods and you should use the one that best corresponds to your IT security policy.

Impact:

None.

Solution

Step 1: Set up the desired log driver following its documentation.
Step 2: Start the docker daemon using that logging driver.
For example:

dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx

Default Value:

By default, container logs are maintained as json files

See Also

https://workbench.cisecurity.org/files/3353

Item Details

References: CSCv6|6.6, CSCv7|6.6, CSCv7|6.8

Plugin: Unix

Control ID: db07e3adcca31178bd2bfd181a80cfb1271b55edcd6e450d39a1b92be9500772