source auditd {
  file(
    /var/log/audit/audit.log

    follow_freq(1)

    default_facility(local6)
    default_priority(info)

    flags(no_parse, sanitize_utf8)

    program_override(auditd)
  );
};