I am currently seeing a lot of auditd dispatch error issues. It is related to a particular keyed rule that from the looks of it is generating close to a million events /day. I have seen previous answers where it was advised to increase the q_depth value to a suitable number.