[Unit] Description=Security Auditing Service After=syslog.target [Service] ExecStart=/usr/sbin/auditd -n ExecStartPost=/usr/sbin/auditctl -R /etc/audit/audit.rules [Install] WantedBy=multi-user.target