journald: if available pull audit messages from the kernel into journal logs

[elogind.git] / units / systemd-journald-audit.socket

diff --git a/units/systemd-journald-audit.socket b/units/systemd-journald-audit.socket
new file mode 100644 (file)
index 0000000..ce849da
--- /dev/null
+++ b/units/systemd-journald-audit.socket
@@ -0,0 +1,18 @@
+#  This file is part of systemd.
+#
+#  systemd is free software; you can redistribute it and/or modify it
+#  under the terms of the GNU Lesser General Public License as published by
+#  the Free Software Foundation; either version 2.1 of the License, or
+#  (at your option) any later version.
+
+[Unit]
+Description=Journal Audit Socket
+Documentation=man:systemd-journald.service(8) man:journald.conf(5)
+DefaultDependencies=no
+Before=sockets.target
+
+[Socket]
+Service=systemd-journald.service
+ReceiveBuffer=128M
+ListenNetlink=audit 1
+PassCredentials=yes