diff --git a/truenas_install/__main__.py b/truenas_install/__main__.py
index d77aaef..0079d08 100644
--- a/truenas_install/__main__.py
+++ b/truenas_install/__main__.py
@@ -450,6 +450,8 @@ def main():
                         rsync.append("var/lib/libvirt/qemu/nvram")
                     if os.path.exists(f"{old_root}/var/lib/netdata"):
                         rsync.append("var/lib/netdata")
+                    if os.path.exists(f"{old_root}/var/lib/syslog-ng/syslog-ng.persist"):
+                        rsync.append("var/lib/syslog-ng/syslog-ng.persist")
                     if "var/log" not in cloned_datasets:
                         try:
                             logs = os.listdir(f"{old_root}/var/log")
diff --git a/truenas_install/fhs.py b/truenas_install/fhs.py
index 0355cbf..66c5a4b 100644
--- a/truenas_install/fhs.py
+++ b/truenas_install/fhs.py
@@ -93,7 +93,8 @@ TRUENAS_DATASETS = [
     {
         'name':  'audit',
         'options': ['NOSUID', 'NOEXEC', 'NOATIME', 'NOACL'],
-        'mode': 0o700
+        'mode': 0o700,
+        'clone': True,
     },
     {
         'name':  'conf',