On 11/1/19 9:49 AM, Steve Grubb wrote:

+1 for me, except I would also question why it would even listen, as to
me it seems that implies storage.

If that's true, I would want to be able to disable it as I do not want
audit events stored elsewhere as well.

It is true. You get 2 copies, one in the journal and it also relays one to 
rsyslog. This should fix it:

systemctl mask systemd-journald-audit.socket

-Steve

Gotcha; thanks Steve.
LCB 

-- 
Lenny Bruzenak
MagitekLTD