[Unit] Description=Security Auditing Service After=syslog.target [Service] ExecStart=/usr/bin/auditd -n ExecStartPost=/usr/bin/auditctl -R /etc/audit/audit.rules [Install] WantedBy=multi-user.target