{
security.auditd.enable = true;
security.audit.enable = true;
# security.audit.rules = [
# "-a exit,always -F arch=b64 -S execve"
# ];
# You can monitor these logs with journalctl -f. If you don't see any audit logs show up, ssh in from another window and run some commands like ls. You should see a flurry of them show up.
}
