1 2 3 4 5 6
{ security.audit = { enable = true; rules = [ "-a exit,always -F arch=b64 -S execve" ]; }; }