2.12 Configure centralized and remote logging

Information

Docker now supports various log drivers. A preferable way to store logs is the one that supports centralized and remote logging.Centralized and remote logging ensures that all important log records are safe despite catastrophic events. Docker now supports various such logging drivers. Use the one that suits your environment the best.

Solution

Step 1- Setup the desired log driver by following its documentation.
Step 2- Start the docker daemon with that logging driver.
For example,
docker run --log-driver=syslog --log-opt syslog-address=tcp-//192.xxx.xxx.xxx

Impact-
None.
Default Value-
By default, container logs are maintained as json files

See Also

https://workbench.cisecurity.org/files/516

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2)

Plugin: Unix

Control ID: 44cc6c28774fb38e1df1f29929becc4d54e80004789238faf8f630ba83fa0b39