API server sets --audit-log-maxbackup to 10

​

What this check verifies

Kubernetes API server audit logging uses --audit-log-maxbackup to set how many rotated audit log files are kept. This evaluates whether that value is explicitly configured as 10 or an approved organizational setting across API server containers.

​

Risk

Insufficient audit log retention reduces accountability and hampers forensics. Limited backups cause older events to be overwritten, letting attackers hide activity until rotation. This undermines the confidentiality, integrity, and availability of evidence needed for incident response.

​

Recommendation

Establish explicit audit log retention. Set --audit-log-maxbackup to 10 or higher based on data sensitivity, and align with --audit-log-maxsize and --audit-log-maxage. Forward logs to centralized, immutable storage, restrict access, and monitor rotation. Apply defense in depth and least privilege to audit systems.

​

Remediation

Dashboard steps

1. SSH to each control plane node
2. Edit the static Pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3. Under spec.containers[0].command, add or update this flag:
   • —audit-log-maxbackup=10
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://kubernetes.io/docs/concepts/cluster-administration/audit/
• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://docs.kics.io/2.0.0/queries/kubernetes-queries/768aab52-2504-4a2f-a3e3-329d5a679848/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_audit_log_maxbackup_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks