[Unit]
Description=Hardware event journal and GPU / disk health sampling
After=systemd-journald.service

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/hwlog collect
TimeoutStartSec=55
Nice=10
IOSchedulingClass=idle
UMask=0027
StateDirectory=hardware-watch
StateDirectoryMode=0750
LogsDirectory=hardware-watch
LogsDirectoryMode=0750
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
NoNewPrivileges=true
ProtectKernelTunables=true
ProtectControlGroups=true
MemoryMax=384M
ReadWritePaths=/var/lib/hardware-watch /var/log/hardware-watch