diff --git a/audit.spec b/audit.spec
index f8f055f7e0dba1e3eea2d8c470f9ebdeb7df8691..5541bf8753fb048a4c86847b43d45c9e64243249 100644
--- a/audit.spec
+++ b/audit.spec
@@ -1,10 +1,12 @@
 %{!?python_sitearch: %define python_sitearch %(%{__python} -c "from distutils.sysconfig import get_python_lib; print get_python_lib(1)")}
 
+%define enable_audit 0
+
 Summary:            User space tools for kernel auditing
 Name:               audit
 Epoch:              1
 Version:            3.0
-Release:            3
+Release:            4
 License:            GPLv2+ and LGPLv2+
 URL:                https://people.redhat.com/sgrubb/audit/
 Source0:            https://people.redhat.com/sgrubb/audit/%{name}-%{version}.tar.gz
@@ -203,7 +205,9 @@ if [ -d "/etc/audisp/" ];then
     fi
 fi
 
+%if %{enable_audit}
 %systemd_post auditd.service
+%endif
 
 %post -n audispd-plugins
 # after installing audispd-plugins
@@ -274,9 +278,11 @@ fi
 
 %postun
 /sbin/ldconfig
+%if %{enable_audit}
 if [ $1 -ge 1 ]; then
    /sbin/service auditd condrestart > /dev/null 2>&1 || :
 fi
+%endif
 
 %files
 %doc README
@@ -368,6 +374,9 @@ fi
 %attr(644,root,root) %{_mandir}/man8/*.8.gz
 
 %changelog
+* Thu Jul 22 2021 yixiangzhike <zhangxingliang3@huawei.com> - 3.0-4
+- keep auditd off by default
+
 * Fri May 28 2021 yixiangzhike <zhangxingliang3@huawei.com> - 3.0-3
 - solve the script failure when package upgrade