The KB mentioned, does not say expected behavior. The cause is : 'consolidation job is not running on the node' but the cause is unknown yet. Have you checked if the "Consolidation job is running on the node" ?, most likely it is not as the space has gone passed 2GB.
Has customer - Deleted and recreated CIFS auditing with different log destination path ?
If the issue still persists after 're-creating' the CIFS Auditing location, then it makes sense to open a ticket (raise a call) with Support and have it investigated.