+[Unit]
+Description=dlog logging service
+Requires=local-fs.target
+After=systemd-tmpfiles-setup.service local-fs.target
+Before=basic.target
+DefaultDependencies=no
+
+# Note:
+# Requires=/After= are added dynamically via dlog-unit-generator (see systemd.generator(7)) if logger
+# devices are available. This is required as dlog_logger has to have devices available and with proper
+# permissions being set before it starts (as we run as 'log' user).
+
+[Service]
+Type=notify
+#
+# Setting TZ prevents logger from repeatedly statting /etc/localtime
+# each time it wanted a timestamp, increasing performance (glibc feature).
+# However, there is a tradeoff as it also sets the timezone in stone.
+#
+# We accept the tradeoff as without caching dlog_logger will be A LOT
+# slower (eg. 30-60% slower). If you dare to touch setting below, be
+# prepared to show vallgrind callgrind and perf data showing the
+# performance penalty.
+Environment=TZ=:/etc/localtime
+NotifyAccess=all
+User=log
+Group=log
+SmackProcessLabel=System
+EnvironmentFile=/etc/isu/service-common.inc
+ExecStart=/bin/isu-sandbox $ISU_SANDBOX_INVOCATION \
+ --bind #ISU_RUN_PATH#/dlog/rootfs/usr/bin/dlog_logger /usr/bin/dlog_logger \
+ --cap-add CAP_SYSLOG \
+ /usr/bin/dlog_logger
+AmbientCapabilities=CAP_SETFCAP CAP_SETUID CAP_SETGID
+SecureBits=keep-caps
+Restart=on-failure
+LimitNOFILE=16384
+Nice=1
+StandardOutput=journal+console
+StandardError=journal+console
+
+[Install]
+WantedBy=basic.target
+