---
title: Docker-related files should be audited in /etc/docker
description: Datadog, the leading service for cloud-scale monitoring.
breadcrumbs: >-
  Docs > Datadog Security > OOTB Rules > Docker-related files should be audited
  in /etc/docker
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# Docker-related files should be audited in /etc/docker
Classification:complianceFramework:cis-dockerControl:1.1.6 
## Description{% #description %}

The `/etc/docker` directory should carry an audit rule, so that the audit log records every change to it and every use of it.

## Rationale{% #rationale %}

`/etc/docker` holds `daemon.json` and the TLS certificates and keys of the Docker daemon. An audit rule on it records who read, changed, or ran it, and when. An investigation of a compromise needs this record.

## Audit{% #audit %}

List the loaded audit rules and look for `/etc/docker`:

```bash
auditctl -l | grep /etc/docker
```

Datadog passes the rule when a loaded audit rule watches `/etc/docker`, fails it when the path exists without a watch, and reports it not applicable when the path is absent.

## Remediation{% #remediation %}

Add a watch for the path to a file in `/etc/audit/rules.d`, then load the rules:

```bash
echo "-w /etc/docker -k docker" >> /etc/audit/rules.d/docker.rules
augenrules --load
```

## Impact{% #impact %}

Every use or change of the path adds a record to the audit log, which needs rotation and room of its own.

## Default value{% #default-value %}

A new installation leaves the audit rules to the administrator, and the rule fails until the watch is added.

## References{% #references %}

1. [https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/system_design_guide/auditing-the-system_system-design-guide)