TMA-DOCKER-2.14

Ensure centralized and remote logging is configured

SedangLevel 2Otomatisdocker

Deskripsi

Centralized logging keeps container logs off the host where they can be tampered with. The audit reads the default logging driver from docker info and fails for the local-only drivers json-file, local and none.

Cara pemeriksaan

Metode audit: Perintah shell

shell

d=$(docker info --format '{{.LoggingDriver}}') || exit 1; case "$d" in json-file|local|none|'') echo "local:$d";; *) echo compliant;; esac

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Set "log-driver" (e.g. syslog, journald forwarded to a collector, fluentd, gelf, splunk) and its "log-opts" in /etc/docker/daemon.json, then restart the Docker daemon.

Properti

Sistem operasi: Apa saja
Tag: dockerdaemonlogging
Referensi: CIS Docker Benchmark v1.9.0 - 2.14 Ensure centralized and remote logging is configured

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target docker --level 2