On a Mac machine, I have installed Ubuntu within a docker container.
In the container, I want to enable Linux Audit Reporter to collect data.
However, auditctl gives me the following error:
Error - audit support not in kernel
Cannot open netlink audit socket
I have enabled AUDIT_CONTROL and ran the container in privileged mode as well but could not get it to work.
Does anyone know if we are able to enable audit reporter for the container, and the procedure for that?