How to Completely Disable ‘auditd’ (Linux Auditing System) in Ubuntu Server

The auditd (Linux Audit daemon) is a powerful, kernel-level logging framework designed to track system calls, file access, and security-relevant events in meticulous detail. In Ubuntu Server, it is a critical component for achieving compliance with rigorous security frameworks (like PCI-DSS or HIPAA). However, auditd is incredibly resource-intensive. If improperly configured, it can generate gigabytes of log data per hour (filling up the /var/log/audit/ partition) and consume massive amounts of CPU overhead simply by intercepting every file execution. If your server is not bound by compliance requirements, or if you are using a lighter alternative (like Falco or eBPF-based tooling), the heavy auditd service should be disabled.

This guide explains how to completely disable the auditd logging framework in Ubuntu Server.

Stop and Disable the Audit Daemon

Because auditd operates directly at the kernel level and utilizes specialized system calls, you cannot simply use systemctl stop and expect it to cease all activity immediately. The correct procedure involves stopping the service, disabling its startup routine, and optionally rebooting to clear the kernel buffers.

1. Log into your Ubuntu Server via SSH or local console with sudo privileges.
2. Stop the active service:

   sudo systemctl stop auditd

   (Note: On some hardened setups, systemd may refuse to stop auditd directly if the RefuseManualStop=yes parameter is set in its unit file. If you encounter an error, proceed directly to step 3 and reboot.)
3. Disable the service so it cannot load during the boot sequence:

   sudo systemctl disable auditd

4. To absolutely guarantee the service cannot be accidentally triggered by another dependent process, mask it:

   sudo systemctl mask auditd

Verify the Audit Subsystem is Dormant

After applying these commands (and ideally rebooting the server to flush the kernel’s active audit context), you can verify that the system is no longer capturing events.

Run the native audit control tool to check the status:

sudo auditctl -s

The system will return an error stating “Error receiving audit netlink packet (Connection refused)” or simply indicate that the daemon is unreachable. The kernel is now completely freed from the overhead of intercepting and logging system calls, restoring maximum disk I/O performance to your workloads.