the only way is with disable_events, but it will disable also auditd events, so there isn't a way to enable auditd event without inotify too