Some test could be tested in two ways

Some test has two ways to test them in CIS, for example test 2.12:

> Run docker info and ensure that the Logging Driverproperty set as appropriate.
`docker info --format '{{ .LoggingDriver }}'`
Alternatively, the below command would give you the --log-driver setting. If configured you should ensure that it is set appropriately.
`ps -ef | grep dockerd`
The contents of /etc/docker/daemon.json should also be reviewed for this setting.

When using the second way we can encounter some false negative, when test was remediated but not shown on ps dockerd.
Other test we should change are:
2.12
2.13
Possibly 2.17

Start with the CIS checks named in the issue: 2.12 and 2.13, with 2.17 as a possible additional case. Compare the docker info command with the dockerd process and /etc/docker/daemon.json checks, then verify that a remediated logging-driver setting is not reported as a failure.

Written by the indexing model from the issue text.