You may sometimes want to stop the auditd service (hopefully temporarily!).
Here the solution to overcome that error message that stops you in your tracks.
You command to stop the service and you get this weird error message:
sudo systemctl stop auditd.service
# Failed to stop auditd.service: Operation refused, unit auditd.service may be
# requested by dependency only (it is configured to refuse manual start/stop).
# See system logs and 'systemctl status auditd.service' for details.
Edit the auditd service configuration (Pick your favorite EDITOR):
sudo EDITOR=vim systemctl edit auditd.service
Then add the following lines at the top of the file, between the override remarks. That's how systemd service files are edited.
### Editing /etc/systemd/system/auditd.service.d/override.conf
### Anything between here and the comment below will become the contents of the drop-in file
[Unit]
RefuseManualStop=no
# ...
### Edits below this comment will be discarded
# ...
Reload the daemon and then you are able to start/stop the service as you want.
sudo systemctl daemon-reload
sudo systemctl stop auditd
Then there's no more frustrating error messages preventing you from stopping
auditd (or any kind of systemd service).