---
title: /var/lib/docker should be audited
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: Docs > Datadog Security > OOTB Rules > /var/lib/docker should be audited
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# /var/lib/docker should be audited
Classification:complianceFramework:cis-dockerControl:1.1.5 
## Description{% #description %}

The Docker data root should carry an audit rule, so that the audit log records every change to it and every use of it.

## Rationale{% #rationale %}

The data root holds the images, containers, and volumes of Docker. An audit rule on it records who read, changed, or ran it, and when. An investigation of a compromise needs this record.

## Audit{% #audit %}

List the loaded audit rules and look for `/var/lib/docker`:

```bash
auditctl -l | grep /var/lib/docker
```

Datadog passes the rule when a loaded audit rule watches `/var/lib/docker`, fails it when the directory exists without a watch, and reports it not applicable when it is absent. It also reports it not applicable when the data root of Docker is another directory, which then needs an audit rule of its own. A data root that user namespace remapping places in a subdirectory of `/var/lib/docker` counts as `/var/lib/docker`.

## Remediation{% #remediation %}

Add a watch for the path to a file in `/etc/audit/rules.d`, then load the rules:

```bash
echo "-w /var/lib/docker -k docker" >> /etc/audit/rules.d/docker.rules
augenrules --load
```

## Impact{% #impact %}

Every use or change of the path adds a record to the audit log, which needs rotation and room of its own.

## Default value{% #default-value %}

A new installation leaves the audit rules to the administrator, and the rule fails until the watch is added.

## References{% #references %}

1. [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide)
1. [https://docs.docker.com/engine/daemon/#daemon-data-directory](https://docs.docker.com/engine/daemon/#daemon-data-directory)