[Unit] Description=Systemd Journal Bridge (SSH Audit Pipeline) After=network.target rsyslog.service [Service] Type=simple ExecStart=/usr/local/bin/syslog-session-bridge Restart=always RestartSec=5 User=root [Install] WantedBy=multi-user.target