But I have a question: why was AUDIT enabled in the first place? I thought itAFAIK, it was considered slow (at least for syscalls), but after recent changeswas cosidered useless?
in kernel it doesn't matter anymore. You can read discussion here https://bugs.archlinux.org/task/42954