Auditing LXC containers

[Alexey Chernenkov]

Hello! I implement a PVE setup with several LXC containers and I need to audit this containers. I tried to install `auditd` and `auditbeat` and had no luck. It seems like these solutions don't work in containers. Is anybody know a working approach for auditing LXC containers? Thanks.

 

[MasinAD]

2,5 years later. We are working on the same problem. At the moment, we resorted back to auditing the host system and correlate audit messages to their respective containers. Auditing in container might be possible by applying CAP_AUDIT or CAP_AUDIT_CONTROL to the container thus giving them control over the hosts complete audit system which might or might not be a bad idea.