"audit" kernel message spam after updating systemd

[plomari]

systemd version the issue has been seen with

254~rc3-3 (?)

Used distribution

Debian unstable

Linux kernel version used

5.10.179

CPU architectures issue was seen on

x86_64

Component

systemd

Expected behaviour you didn't see

No log spam.

Unexpected behaviour you saw

After a systemd update, without reboot and without kernel update, "audit" messages started appearing in the kernel log. There are many different types of messages. Some happen while doing something (like logging in with a user with su, or crashing a program), some come in regular intervals without interacting with the system. I added an example below.

Why, and how do I stop them?

I don't know what this "audit" mechanism is good for, but I don't want them in my logs. At least not all of them. They hide more important messages.

Steps to reproduce the problem

Travel back in time to some weeks ago and run apt dist-upgrade on Debian unstable.

Additional program output to the terminal or log subsystem illustrating the issue

audit: type=1106 audit(1690548901.216:2783): pid=3949631 uid=0 auid=0 ses=9484 msg='op=PAM:session_close grantors=pam_loginuid,pam_env,pam_env,pam_permit,pam_unix,pam_limits acct="root" exe="/usr/sbin/cron" hostname=? addr=? terminal=cron res=success'

[bluca]

As the package news said, you need to disable systemd-journald-audit.socket if you don't want audit messages

[plomari]

That doesn't seem to stop most messages. With smbd, they're even getting logged for certain common file system operations. This is pretty unreasonable logging behavior.

[bluca]

You can disable the socket, and/or you can set Audit=no in /etc/systemd/journald.conf https://www.freedesktop.org/software/systemd/man/journald.conf.html#Audit=

[plomari]

I used

 systemctl disable systemd-journald-audit.socket 
 systemctl stop systemd-journald-audit.socket 

2 days ago, which didn't seem to help much. I'll try that config option, thanks.

[plomari]

Adding the option and restarting systemd-journald didn't help, a simple "su - root" still triggered an audit message.

[atus42]

this problem still/partially exist in ubuntu 24.04.4
we have two almost identical server with
systemd version: 255.4-1ubuntu8.12
kernel version: 6.8.0-101-generic
On one of them, the kernel spams audit messages to syslog, on the other it didn't. I allready spent hours to find the difference, yet not to find any (relevant).