In /var/log/kernellog we can see many entries for audit (since we have "space_left_action = SYSLOG" and "write_logs = no"):
...
audit: audit_backlog=32769 > audit_backlog_limit=32768
audit: audit_lost=1 audit_rate_limit=0 audit_backlog_limit=32768
audit: backlog limit exceeded
...
The Question: Could it be that a server crashes/stops if it cannot process the too much audit infos? FS holding kernellog having enough free space.