---
title: /usr/bin/containerd should be audited if applicable
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > /usr/bin/containerd should be audited
  if applicable
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# /usr/bin/containerd should be audited if applicable
Classification:complianceFramework:cis-dockerControl:1.1.14 
## Description{% #description %}

The containerd binary should carry an audit rule, so that the audit log records every change to it and every use of it.

## Rationale{% #rationale %}

containerd runs as root and starts the containers of Docker. An audit rule on it records who read, changed, or ran it, and when. An investigation of a compromise needs this record.

## Audit{% #audit %}

List the loaded audit rules and look for `/usr/bin/containerd`:

```bash
auditctl -l | grep /usr/bin/containerd
```

Datadog passes the rule when a loaded audit rule watches `/usr/bin/containerd`, fails it when the path exists without a watch, and reports it not applicable when the path is absent.

## Remediation{% #remediation %}

Add a watch for the path to a file in `/etc/audit/rules.d`, then load the rules:

```bash
echo "-w /usr/bin/containerd -k docker" >> /etc/audit/rules.d/docker.rules
augenrules --load
```

## Impact{% #impact %}

Every use or change of the path adds a record to the audit log, which needs rotation and room of its own.

## Default value{% #default-value %}

A new installation leaves the audit rules to the administrator, and the rule fails until the watch is added.

## References{% #references %}

1. [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide)
1. [https://containerd.io/](https://containerd.io/)