Detections
Analytics

5.7.2 Enable Linux auditd logging for Container Optimized OS GKE nodes

Information

Enable Linux auditd logging for GKE nodes running Container Optimized OS to collect detailed operating system audit events from the node. These logs provide host level visibility into activity such as login attempts, error messages, and binary executions, and can be forwarded to Cloud Logging using the supported logging agent configuration.

Linux auditd logging improves node level security visibility by capturing operating system events that are not fully represented by Kubernetes workload logs, Cloud Audit Logs, or standard cluster telemetry. This information can help support troubleshooting, incident investigation, and detection of suspicious host level activity on GKE nodes running Container Optimized OS.

Because GKE nodes run workloads that may interact with the underlying host, detailed operating system audit logs can provide additional evidence during a security investigation, including process execution, authentication activity, and other node level events. This control is especially useful when host level visibility is required beyond normal GKE logging and monitoring.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Deploy an approved Linux auditd logging DaemonSet when the audit returns no matching auditd or cos-auditd DaemonSets or Pods. The DaemonSet should run on eligible Container Optimized OS nodes and forward Linux audit events to Cloud Logging or another approved log destination.

 - Download the current GKE example manifest for Linux auditd logging on Container Optimized OS nodes.

curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/troubleshooting/os-audit/cos-auditd-logging.yaml > cos-auditd-logging.yaml

 -

Review the manifest before deployment, including the namespace, DaemonSet name, node selectors, ConfigMap settings, and logging destination.

 -

Replace any sample logging agent image with an approved image from a trusted source and pin it by digest where required.

 -

Tune the auditd and fluent-bit configuration to control log volume, filtering, retention, routing, and cost.

 -

Deploy the approved manifest to the cluster.

kubectl apply -f cos-auditd-logging.yaml

 - After deployment, rerun the audit commands and confirm that the approved DaemonSet exists and that the audit logging Pods are running on eligible Container Optimized OS nodes.

Impact:

Enabling Linux auditd logging can increase node resource usage and Cloud Logging ingestion volume, which may increase cost and affect log retention planning. Teams should tune audit rules, logging agent configuration, retention, exclusions, and alerting so the collected events support security monitoring.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.3

Plugin: GCP

Control ID: 7474f7a249dbfbb15e8bc3c4c2265f57ee164129722b54fcfce92703f6f9a11c