Audit both a host and the containers on it using auditd.