But I have a question: why was AUDIT enabled in the first place? I thought itAFAIK, it was considered slow (at least for syscalls), but after recent changeswas cosidered useless?
in kernel it doesn't matter anymore.
You can read discussion here https://bugs.archlinux.org/task/42954
