Add an upstart config example

README.md

@@ -61,6 +61,9 @@ rules:
   - -a exit,always -F arch=b32 -S execve
 ```
 
+##### Running as a service
+
+Check the `contrib` folder, it contains examples for how to run `go-audit` as a proper service on your machine.
 
 ## FAQ
 

contrib/upstart.go-audit.conf

@@ -0,0 +1,21 @@
+description "go-audit server"
+
+start on runlevel [2345]
+stop on runlevel [!2345]
+
+respawn
+respawn limit 10 5
+
+script
+    # Catch any output from stdout/stderr and forward to syslog
+    rm -f "/tmp/go-audit.log"
+    mkfifo "/tmp/go-audit.log"
+    (setsid logger -t"go-audit" <"/tmp/go-audit.log" &)
+    exec >"/tmp/go-audit.log" 2>"/tmp/go-audit.log"
+    rm "/tmp/go-audit.log"
+
+    # There can be only one auditd
+    /etc/init.d/auditd stop
+
+    exec /usr/local/bin/go-audit
+end script