# Ensure Auditing is Configured for the Docker Daemon

- Source: https://support.icompaas.com/support/solutions/articles/62000234291-ensure-auditing-is-configured-for-the-docker-daemon
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS Docker Benchmark v1.7.0](https://support.icompaas.com/support/solutions/62000112687) › [CIS Docker Benchmark](https://support.icompaas.com/support/solutions/folders/62000169241)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Profile Applicability:**

-   **Level 1** 
    

**Description:**

Auditing Docker daemon activities is essential as the daemon runs with root privileges. It is important to audit its actions and usage to ensure that any suspicious activities can be detected and investigated.  

**Rationale:**

The Docker daemon operates with root privileges and controls critical aspects of containerized environments. Auditing its operations allows organizations to detect and respond to potential security incidents that could arise from misuse or exploitation of the Docker daemon.  

**Impact:**

**Pros:**  

-   Provides visibility into Docker daemon activities, improving security and incident detection.  
    
-   Helps in forensic investigations by retaining detailed logs of daemon activities.  
    

**Cons:**  

-   Auditing can generate large log files, which may require regular management (rotation, archiving).  
    
-   A separate partition for audit logs might be necessary to avoid filling up other critical partitions.  
    

**Default Value:**

-   By default, Docker daemon activities are not audited.  
    

**Pre-requisites:**

-   Access to the Docker host system with administrative privileges.  
    
-   Knowledge of configuring audit rules on the system.  
    

**Remediation:**

**Test Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance running Docker.  
    
2.  Verify if there are audit rules for the Docker daemon by checking the system’s audit rules:  
    

auditctl -l | grep /usr/bin/dockerd

**Using AWS CLI:**

1.  Connect to the EC2 instance.  
    
2.  Run the following command to check if the Docker daemon has associated audit rules:  
    

auditctl -l | grep /usr/bin/dockerd

**Implementation Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.  
    
2.  Add an audit rule for the Docker daemon by editing the /etc/audit/rules.d/audit.rules file:  
    
3.  Restart the audit daemon to apply the changes:  
      
    

**Using AWS CLI:**

1.  Use SSM to remotely add the audit rule and restart the audit daemon:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["echo \\'-w /usr/bin/dockerd -k docker\\' >> /etc/audit/rules.d/audit.rules && sudo systemctl restart auditd"\]

  

**Backout Plan:**

**Using AWS Console:**

1.  Log in to the EC2 instance.  
    
2.  Remove the audit rule by editing the /etc/audit/rules.d/audit.rules file and deleting the line:\-w /usr/bin/dockerd -k docker  
    
3.  Restart the audit daemon to apply the changes:  
    sudo systemctl restart auditd  
    

**Using AWS CLI:**

1.  Use SSM to remotely remove the audit rule and restart the audit daemon:  
    

aws ssm send-command --document-name "AWS-RunShellScript" --targets "Key=instanceIds,Values=instance\_id" --parameters 'commands=\["sed -i \\'/\\-w \\/usr\\/bin\\/dockerd -k docker/d\\' /etc/audit/rules.d/audit.rules && sudo systemctl restart auditd"\]'

  

**References:**

-   CIS Docker Benchmark v1.7  
    
-   Red Hat Auditing Documentation: [https://access.redhat.com/documentation/en-us/red\_hat\_enterprise\_linux/8/html/system\_design\_guide/auditing-the-system\_system-design-guide](https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.