Software :: Red Hat 9 - Replicating And Identifying The Root Cause

I just encountered a very weird issue and I am having hard time replicating and identifying the root cause. We have one RH9 server and we received an alert that the /var reached 85%, I checked and found out that /var/log/audit.d is occupying most of the space. It has a lot of files inside it consisting file size of 21MB each everyday. I ask the customer if can housekeep and it eventually climbed up to 100%. My colleague did some house keeping but what he did was he compressed the audit.d directory and remove it.

After that users are complaining they cannot telnet to the server even though the service is on. I have recreated the audit.d directory and restarted the xinetd as usual. Still the same problem. And the weird thing is that I cannot even switch to any user from the root. I tried to do "su - someuser" but it hangs there without doing anything. I also tried to telnet, it will ask for login and password but same thing it hangs in there. Did some restart on xinetd and did "chkconfig telnet off" "chkconfig telnet on" but with no success. Could this be caused by the deletion of audit.d? Or is the 100% utilization of /var the system could not cope up? The good thing is everything worked fine after restart. But still the root cause is unknown. If I check /var/log/secure it shows the user being authenticated though it is not getting any session. /var/log/messages also does not reveal anything.