2.13 Ensure centralized and remote logging is configured

Information

Docker supports various logging mechanisms. A preferable method for storing logs is one that supports centralized and remote management.

Rationale:

Centralized and remote logging ensures that all important log records are safe even in the event of a major data availability issue . Docker supports various logging methods and you should use the one that best corresponds to your IT security policy.

Impact:

None.

Solution

Step 1: Set up the desired log driver following its documentation.
Step 2: Start the docker daemon using that logging driver.
For example:

dockerd --log-driver=syslog --log-opt syslog-address=tcp://192.xxx.xxx.xxx

Default Value:

By default, container logs are maintained as json files

See Also

https://workbench.cisecurity.org/benchmarks/11818

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-1, 800-53|AU-2, 800-53|AU-6(3), CSCv7|6.6, CSCv7|6.8

Plugin: Unix

Control ID: 396e2c5da1f72472e0c664f6584c57ef042008f18cf278bca2a92ba14c45bebc