Cannot disable kernel's audit system via auditctl

Hi linux-audit, I'm running a fleet of Linux hosts with Red Canary Linux EDR (Endpoint Detection and Response) which uses eBPF for gathering telemetry in service ` cfsvcd.service`. In an older configuration, it gathered data from the kernel's audit system and everything was fine. However, when we switched cfsvcd to gathering data from eBPF instead, we noticed that the kernel ring buffer was flooded with audit messages. This is because cfsvcd.service now stops auditd.service, but leaves the kernel audit system enabled. I've mitigated this issue by manually running `# auditctl -e 0` on our hosts (via Puppet). However, I'm running into a strange issue where _some_ hosts (~0.5%) are still logging all audit events to the kernel ring buffer even after I have disabled the audit system via `# auditctl -e 0`. A `# auditctl -s` run shows `enabled 0`, yet audit logs continue to flood the kernel ring buffer. I'm running Linux kernel 5.4.0-1063-aws on Ubuntu 18.04 with auditctl v2.8.2. `systemd-journald-audit.socket` is masked & inactive, ` auditd.service` is disabled & inactive. I cannot entirely disable the audit system via a kernel parameter because Red Canary Linux EDR fails to start cfsvcd.service as it fails to run some auditctl command due to no audit support in the kernel: Jun 28 20:41:04 systemd[1]: Started Canary Forwarder Service. Here's the unit file for cfsvcd.service: Is this a known issue? Is there a workaround to stop the logging to the kernel ring buffer? Is there any more information I can provide to help debug? Thanks, Samuel Bahr Pinterest Sr. Site Reliability Engineer