I'm finding that auditd will in fact log to the console if I run it with -f (don't fork). But it's not writing the entries to /var/log/audit/audit.log. I think I have enough disk space. The default config suspends auditing when free space falls below 50 and 75 megabytes, and df shows over 6 GB available.