I guess you are talking about 'audit' logs for NAS ?
For audit logs, there are '2' volumes which are separate and should ideally be nothing to do with SVM root volume.
Audit records are initially stored in binary staging files (on staging volume MDV*) and later consolidated and converted to user-readable event logs, which are stored in the audit event log directory (Existing_non_root or separate small size volume) for the SVM. Even though the size of the log directory is 200MB (with log rotation), shouldn't be on svm_root_vol.
You can check staging volume space usage:
::> df -h MDV*
::> volume show -vserver <cluster> -volume MDV*
::*> set diag
::*> volume size -vserver <cluster> -volume MDV_aud_*
To resize "log directory" volume, you can resize normally without going into diag level.
How to troubleshoot space issues related to the staging volumes
On the side note: There is another 'root volume'(Most IMPORTANT one) which is Node's root volume (Part of the root aggregate): which is reserved for system files, log files, and core dump files.