The files inside the Event Queue folder are being processed, but not as fast as it should, impacting in the hard disk growth used space.
The IOPs are not the ones that Symantec recommends, and the hard disk is not fast enough to deal with the writing and reading process.
The disk where the Event Queue folder is stored does not have the minimum requirements for disk space and/or IOPs.
Event Queue path can be changed via the following registry:
Changes will be applied after all services are restarted.
The recommended way to change path values is as follow:
NOTE: Do not redirect the EventQueues to the NSCap directory structure as it may stop NSEs from being processed. This is because old NSCap folders are monitored by an event dispatcher for legacy NSEs, which are put as files into subfolders. If you point the dispatcher to one of the subfolders, it will create files there and they will immediately be caught as new NSEs from legacy solutions and routed again to the dispatcher.
For more information about this issue, please see the following article: www.symantec.com/docs/TECH183959