# Cis Docker V160 2.3

> Cis Docker V160 2.3 is an Agent Skill for devops & security published in the CyberStrikeus/CyberStrike repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Ensure the logging level is set to 'info'

- Skill name: `cis-docker-v160-2.3`
- Category: [DevOps & Security](https://www.openparable.com/skill/devops-security/1)
- Source: https://github.com/CyberStrikeus/CyberStrike/blob/HEAD/.cyberstrike/skill/CIS_benchmarks/Server_Software/Docker/CIS_Docker_Benchmark_v1.6.0/cis-docker-v160-2.3/SKILL.md
- Repository: CyberStrikeus/CyberStrike (1,211 GitHub stars when collected)

## SKILL.md

# Ensure the logging level is set to 'info'

**Profile Applicability:** Level 1 - Docker - Linux

**Assessment Status:** Manual

## Description

Set Docker daemon log level to `info`.

## Rationale

Setting up an appropriate log level, configures the Docker daemon to log events that you would want to review later. A base log level of `info` and above would capture all logs except debug logs. Until and unless required, you should not run Docker daemon at `debug` log level.

## Impact

None.

## Audit Procedure

To confirm this setting a combination of reviewing the dockerd start-up options and a review of any settings in `/etc/docker/daemon.json` should be completed.
To review the dockerd startup options, use:

```bash
ps -ef | grep dockerd
```

Ensure that either the `--log-level` parameter is not present or if present, then it is set to `info`.
The contents of `/etc/docker/daemon.json` should also be reviewed for this setting.

## Remediation

Ensure that the Docker daemon configuration file has the following configuration included:

```json
"log-level": "info"
```

Alternatively, run the Docker daemon as below:

```bash
dockerd --log-level="info"
```

## Default Value

By default, Docker daemon is set to log level of `info`.

## References

1. https://docs.docker.com/engine/reference/commandline/dockerd/

## CIS Controls

| Controls Version | Control                                                                                                                                                                                                                                                                                 | IG 1 | IG 2 | IG 3 |
| ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- |
| v8               | 8.5 Collect Detailed Audit Logs<br>Configure detailed audit logging for enterprise assets containing sensitive data. Include event source, date, username, timestamp, source addresses, destination addresses, and other useful elements that could assist in a forensic investigation. |      | ●    | ●    |
| v7               | 6.2 Activate audit logging<br>Ensure that local logging has been enabled on all systems and networking devices.                                                                                                                                                                         | ●    | ●    | ●    |
| v7               | 6.3 Enable Detailed Logging<br>Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.                                                                                |      | ●    | ●    |

## Profile/Assessment Status

**Profile:** Level 1 - Docker - Linux
**Assessment Status:** Manual

---

Source: https://www.openparable.com/skill/devops-security/cis-docker-v160-2-3 (OpenParable). Cite the canonical URL above.