[Unit] Description=Security Auditing Service After=syslog.target [Service] ExecStart=/sbin/auditd -n ExecStartPost=/sbin/auditctl -R /etc/audit/audit.rules [Install] WantedBy=multi-user.target