Thanks for your reply. here are the results.
df -m /vol/root_vol/
Filesystem total used avail capacity Mounted on
/vol/root_vol/ 291840MB 52155MB 239684MB 18% /vol/root_vol/
/vol/root_vol/.snapshot 15360MB 585MB 14774MB 4% /vol/root_vol /.snapshot
Also, as stated earlier- is happens on random basis. Once we turn on auditing manually, it works fine for few days.