Лог жизни

Боремся:
You can quickly disable audit temporarily with

$ sudo auditctl -e 0

and temporarily remove all the rules with

$ sudo auditctl -D

For future boots you could try disabling its start with

$ sudo systemctl disable auditd

До кучи:
# systemctl disable systemd-journald-audit.socket
# systemctl stop systemd-journald-audit.socket