How to temporarily stop auditd daemon

Disable auditd daemon during operating system image build process to prevent unnecessary log spikes.

You cannot stop auditd service using service module or systemctl command.

- name: Stop auditd, but ensure that it is enabled at boot
  service:
    name: auditd
    state: stopped
    enabled: true

$ sudo systemctl stop auditd

The log output taken from ansible.

Unable to stop service auditd: Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by dependency only (it is configured to refuse manual start/stop).
See system logs and 'systemctl status auditd.service' for details.

Use service utility as a workaround.

- name: Ensure that it is enabled at boot
  service:
    name: auditd
    enabled: true
- name: Stop auditd
  command: /sbin/service auditd stop

$ sudo /sbin/service auditd stop

The log output taken from ansible.

Consider using the service module rather than running 'service'.

Ignore this automatic advice.