TMA-DOCKER-2.14

Ensure centralized and remote logging is configured

MediumLevel 2Automateddocker

Description

Centralized logging keeps container logs off the host where they can be tampered with. The audit reads the default logging driver from docker info and fails for the local-only drivers json-file, local and none.

How it is checked

Audit method: Shell command

shell

d=$(docker info --format '{{.LoggingDriver}}') || exit 1; case "$d" in json-file|local|none|'') echo "local:$d";; *) echo compliant;; esac

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Set "log-driver" (e.g. syslog, journald forwarded to a collector, fluentd, gelf, splunk) and its "log-opts" in /etc/docker/daemon.json, then restart the Docker daemon.

Properties

Operating systems: Any
Tags: dockerdaemonlogging
Reference: CIS Docker Benchmark v1.9.0 - 2.14 Ensure centralized and remote logging is configured

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target docker --level 2