See this issue: Cannot disable audit logging after adding a socket device without a port number · Issue #10604 · hashicorp/vault · GitHub
My question: How do I remove an audit device when I’m using the file system as the storage backend? (Removing via the CLI does not work, even when logged in as root.)
I’ve tried to stop vault, remove core/_audit and core/_local-audit files and the audit folder, start and unseal again, but none of these tricks worked. Vault still knew about the audit device, so I’m guessing it’s stored somewhere else?