From 6d9c4e7d39076d0aa5f17ee736ed17626ec144dd Mon Sep 17 00:00:00 2001
From: Aykhan Shahsuvarov <aykhan.shahs@gmail.com>
Date: Mon, 13 Jul 2026 04:34:51 +0400
Subject: [PATCH] crowdsec: use sshd.service unit for journalctl ssh
 acquisition on NixOS

---
 crowdsec/acquis.d/sshd.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/crowdsec/acquis.d/sshd.yaml b/crowdsec/acquis.d/sshd.yaml
index b057656..5ab8006 100644
--- a/crowdsec/acquis.d/sshd.yaml
+++ b/crowdsec/acquis.d/sshd.yaml
@@ -1,5 +1,6 @@
 source: journalctl
 journalctl_filter:
-  - "_SYSTEMD_UNIT=ssh.service"
+  # NixOS names the OpenSSH unit "sshd.service"; Debian/Ubuntu use "ssh.service".
+  - "_SYSTEMD_UNIT=sshd.service"
 labels:
   type: syslog