diff --git a/.etckeeper b/.etckeeper
index 02967845..2458edb9 100755
--- a/.etckeeper
+++ b/.etckeeper
@@ -317,15 +317,6 @@ maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/debian-archive-stretch-stable.gpg'
 maybe chmod 0644 'apt/trusted.gpg.d/mariadb-keyring-2019.gpg'
-maybe chmod 0750 'audit'
-maybe chmod 0640 'audit/audit-stop.rules'
-maybe chmod 0640 'audit/audit.rules'
-maybe chmod 0640 'audit/auditd.conf'
-maybe chmod 0750 'audit/plugins.d'
-maybe chmod 0640 'audit/plugins.d/af_unix.conf'
-maybe chmod 0640 'audit/plugins.d/syslog.conf'
-maybe chmod 0750 'audit/rules.d'
-maybe chmod 0640 'audit/rules.d/audit.rules'
 maybe chmod 0644 'bash.bashrc'
 maybe chmod 0644 'bash_completion'
 maybe chmod 0755 'bash_completion.d'
@@ -477,7 +468,6 @@ maybe chmod 0644 'debian_version'
 maybe chmod 0755 'default'
 maybe chmod 0644 'default/acct'
 maybe chmod 0644 'default/amavisd-snmp-subagent'
-maybe chmod 0644 'default/auditd'
 maybe chmod 0644 'default/console-setup'
 maybe chmod 0644 'default/cron'
 maybe chmod 0644 'default/dbus'
@@ -904,7 +894,6 @@ maybe chmod 0755 'init.d/amavis'
 maybe chmod 0755 'init.d/amavis-mc'
 maybe chmod 0755 'init.d/amavisd-snmp-subagent'
 maybe chmod 0755 'init.d/apparmor'
-maybe chmod 0755 'init.d/auditd'
 maybe chmod 0755 'init.d/clamav-daemon'
 maybe chmod 0755 'init.d/clamav-freshclam'
 maybe chmod 0755 'init.d/cloud-config'
diff --git a/audit/audit-stop.rules b/audit/audit-stop.rules
deleted file mode 100644
index 7e23cff4..00000000
--- a/audit/audit-stop.rules
+++ /dev/null
@@ -1,8 +0,0 @@
-# These rules are loaded when the audit daemon stops
-# if configured to do so.
-
-# Disable auditing
--e 0
-
-# Delete all rules
--D
diff --git a/audit/audit.rules b/audit/audit.rules
deleted file mode 100644
index d3d6609f..00000000
--- a/audit/audit.rules
+++ /dev/null
@@ -1,6 +0,0 @@
-## This file is automatically generated from /etc/audit/rules.d
--D
--b 8192
--f 1
---backlog_wait_time 60000
-
diff --git a/audit/auditd.conf b/audit/auditd.conf
deleted file mode 100644
index f3fd96c4..00000000
--- a/audit/auditd.conf
+++ /dev/null
@@ -1,39 +0,0 @@
-#
-# This file controls the configuration of the audit daemon
-#
-
-local_events = yes
-write_logs = yes
-log_file = /var/log/audit/audit.log
-log_group = adm
-log_format = ENRICHED
-flush = INCREMENTAL_ASYNC
-freq = 50
-max_log_file = 8
-num_logs = 5
-priority_boost = 4
-name_format = NONE
-##name = mydomain
-max_log_file_action = ROTATE
-space_left = 75
-space_left_action = SYSLOG
-verify_email = yes
-action_mail_acct = root
-admin_space_left = 50
-admin_space_left_action = SUSPEND
-disk_full_action = SUSPEND
-disk_error_action = SUSPEND
-use_libwrap = yes
-##tcp_listen_port = 60
-tcp_listen_queue = 5
-tcp_max_per_addr = 1
-##tcp_client_ports = 1024-65535
-tcp_client_max_idle = 0
-transport = TCP
-krb5_principal = auditd
-##krb5_key_file = /etc/audit/audit.key
-distribute_network = no
-q_depth = 400
-overflow_action = SYSLOG
-max_restarts = 10
-plugin_dir = /etc/audit/plugins.d
diff --git a/audit/plugins.d/af_unix.conf b/audit/plugins.d/af_unix.conf
deleted file mode 100644
index a5ba8b1f..00000000
--- a/audit/plugins.d/af_unix.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-
-# This file controls the configuration of the
-# af_unix socket plugin. It simply takes events
-# and writes them to a unix domain socket. This
-# plugin can take 2 arguments, the path for the
-# socket and the socket permissions in octal.
-
-active = no
-direction = out
-path = builtin_af_unix
-type = builtin 
-args = 0640 /var/run/audispd_events
-format = string
-
diff --git a/audit/plugins.d/syslog.conf b/audit/plugins.d/syslog.conf
deleted file mode 100644
index e8aebdfe..00000000
--- a/audit/plugins.d/syslog.conf
+++ /dev/null
@@ -1,14 +0,0 @@
-# This file controls the configuration of the syslog plugin.
-# It simply takes events and writes them to syslog. The
-# arguments provided can be the default priority that you
-# want the events written with. And optionally, you can give
-# a second argument indicating the facility that you want events
-# logged to. Valid options are LOG_LOCAL0 through 7, LOG_AUTH,
-# LOG_AUTHPRIV, LOG_DAEMON, LOG_SYSLOG, and LOG_USER.
-
-active = no
-direction = out
-path = /sbin/audisp-syslog
-type = always 
-args = LOG_INFO
-format = string
diff --git a/audit/rules.d/audit.rules b/audit/rules.d/audit.rules
deleted file mode 100644
index b86d66f9..00000000
--- a/audit/rules.d/audit.rules
+++ /dev/null
@@ -1,13 +0,0 @@
-## First rule - delete all
--D
-
-## Increase the buffers to survive stress events.
-## Make this bigger for busy systems
--b 8192
-
-## This determine how long to wait in burst of events
---backlog_wait_time 60000
-
-## Set failure mode to syslog
--f 1
-
diff --git a/default/auditd b/default/auditd
deleted file mode 100644
index f4a877df..00000000
--- a/default/auditd
+++ /dev/null
@@ -1,12 +0,0 @@
-# Add extra options here
-EXTRAOPTIONS=""
-
-# This option is used to determine if rules & watches should be deleted on
-# shutdown by loading the audit-stop file. This is beneficial in most cases
-# so that a watch doesn't linger on a drive that is being unmounted. If
-# set to no, it will NOT be cleaned up.
-AUDITD_CLEAN_STOP="no"
-
-# This option determines whether or not to call augenrules to compile the
-# audit rules from /etc/audit/rules.d. The default is "yes".
-USE_AUGENRULES="yes"
diff --git a/init.d/auditd b/init.d/auditd
deleted file mode 100755
index 2ed72876..00000000
--- a/init.d/auditd
+++ /dev/null
@@ -1,152 +0,0 @@
-#! /bin/sh
-### BEGIN INIT INFO
-# Provides:          auditd
-# Required-Start:    $remote_fs
-# Required-Stop:     $local_fs
-# Default-Start:     2 3 4 5
-# Default-Stop:      0 1 6
-# Short-Description: Audit Daemon
-# Description:       Collects audit information from Linux 2.6 Kernels.
-### END INIT INFO
-
-# Author: Philipp Matthias Hahn <pmhahn@debian.org>
-# Based on Debians /etc/init.d/skeleton and Auditds init.d/auditd.init
-
-# PATH should only include /usr/* if it runs after the mountnfs.sh script
-PATH=/sbin:/usr/sbin:/bin:/usr/bin
-DESC="audit daemon"
-NAME=auditd
-DAEMON=/sbin/auditd
-PIDFILE=/var/run/"$NAME".pid
-SCRIPTNAME=/etc/init.d/"$NAME"
-
-# Exit if the package is not installed
-[ -x "$DAEMON" ] || exit 0
-
-# Read configuration variable file if it is present
-[ -r /etc/default/"$NAME" ] && . /etc/default/"$NAME"
-
-# Define LSB log_* functions.
-. /lib/lsb/init-functions
-
-#
-# Function that starts the daemon/service
-#
-do_start()
-{
-	# Return
-	#   0 if daemon has been started
-	#   1 if daemon was already running
-	#   2 if daemon could not be started
-	start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" --test > /dev/null \
-		|| return 1
-	start-stop-daemon --start --quiet --pidfile "$PIDFILE" --exec "$DAEMON" -- \
-		$EXTRAOPTIONS \
-		|| return 2
-        # Call augenrules to compile audit rules.
-        case "$USE_AUGENRULES" in
-                no|NO) ;;
-                *) [ -d /etc/audit/rules.d ] && /sbin/augenrules >/dev/null ;;
-        esac
-	if [ -f /etc/audit/audit.rules ]
-	then
-		/sbin/auditctl -R /etc/audit/audit.rules >/dev/null
-	fi
-}
-
-#
-# Function that stops the daemon/service
-#
-do_stop()
-{
-	# Return
-	#   0 if daemon has been stopped
-	#   1 if daemon was already stopped
-	#   2 if daemon could not be stopped
-	#   other if a failure occurred
-	start-stop-daemon --stop --quiet --retry=TERM/30/KILL/5 --pidfile "$PIDFILE" --name "$NAME"
-	RETVAL="$?"
-	[ "$RETVAL" = 2 ] && return 2
-	start-stop-daemon --stop --quiet --oknodo --retry=0/30/KILL/5 --exec "$DAEMON"
-	[ "$?" = 2 ] && return 2
-	# Many daemons don't delete their pidfiles when they exit.
-	rm -f "$PIDFILE"
-	rm -f /var/run/audit_events
-	# Remove watches so shutdown works cleanly
-	case "$AUDITD_CLEAN_STOP" in
-		no|NO) ;;
-		*) /sbin/auditctl -R /etc/audit/audit-stop.rules >/dev/null ;;
-	esac
-	return "$RETVAL"
-}
-
-#
-# Function that sends a SIGHUP to the daemon/service
-#
-do_reload() {
-	start-stop-daemon --stop --signal HUP --quiet --pidfile $PIDFILE --name $NAME
-	return 0
-}
-
-case "$1" in
-  start)
-	log_daemon_msg "Starting $DESC" "$NAME"
-	do_start
-	case "$?" in
-		0|1) log_end_msg 0 ;;
-		2) log_end_msg 1 ;;
-	esac
-	;;
-  stop)
-	log_daemon_msg "Stopping $DESC" "$NAME"
-	do_stop
-	case "$?" in
-		0|1) log_end_msg 0 ;;
-		2) log_end_msg 1 ;;
-	esac
-	;;
-  reload|force-reload)
-	log_daemon_msg "Reloading $DESC" "$NAME"
-	do_reload
-	log_end_msg $?
-	;;
-  restart)
-	log_daemon_msg "Restarting $DESC" "$NAME"
-	do_stop
-	case "$?" in
-	  0|1)
-		do_start
-		case "$?" in
-			0) log_end_msg 0 ;;
-			1) log_end_msg 1 ;; # Old process is still running
-			*) log_end_msg 1 ;; # Failed to start
-		esac
-		;;
-	  *)
-		# Failed to stop
-		log_end_msg 1
-		;;
-	esac
-	;;
-  rotate)
-	log_daemon_msg "Rotating $DESC logs" "$NAME"
-	start-stop-daemon --stop --signal USR1 --quiet --pidfile "$PIDFILE" --name "$NAME"
-	log_end_msg $?
-	;;
-  status)
-	pidofproc -p "$PIDFILE" "$DAEMON" >/dev/null
-	status=$?
-	if [ $status -eq 0 ]; then
-		log_success_msg "$NAME is running."
-	else
-		log_failure_msg "$NAME is not running."
-	fi
-	exit $status
-	;;
-  *)
-	echo "Usage: $SCRIPTNAME {start|stop|restart|reload|force-reload|rotate|status}" >&2
-	exit 3
-	;;
-esac
-
-:
diff --git a/rc0.d/K01auditd b/rc0.d/K01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc0.d/K01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc1.d/K01auditd b/rc1.d/K01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc1.d/K01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc2.d/S01auditd b/rc2.d/S01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc2.d/S01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc3.d/S01auditd b/rc3.d/S01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc3.d/S01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc4.d/S01auditd b/rc4.d/S01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc4.d/S01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc5.d/S01auditd b/rc5.d/S01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc5.d/S01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/rc6.d/K01auditd b/rc6.d/K01auditd
deleted file mode 120000
index d4d8d307..00000000
--- a/rc6.d/K01auditd
+++ /dev/null
@@ -1 +0,0 @@
-../init.d/auditd
\ No newline at end of file
diff --git a/systemd/system/multi-user.target.wants/auditd.service b/systemd/system/multi-user.target.wants/auditd.service
deleted file mode 120000
index 32f1ce2f..00000000
--- a/systemd/system/multi-user.target.wants/auditd.service
+++ /dev/null
@@ -1 +0,0 @@
-/lib/systemd/system/auditd.service
\ No newline at end of file