module(load="imfile") input(type="imfile" file="/var/log/audit/audit.log" statefile="imfile-state:-var-log-audit-audit.log" tag="auditd-sender" severity="info" facility="local6")