One or more enrolled Symantec Endpoint Protecton (SEP) clients fail to send Endpoint Activity Recorder (EAR) activity events to Symantec Endpoint Detection and Response (SEDR).
On the Windows Explorer of the SEP client which does not send EAR events to SEDR, confirm free hard drive space on C:\ drive of the SEP client
Within SEDR UI, confirm the configured reserve space for EAR activities on the Data Recorder confiuration for the SEPM where the SEP client is managed.
If free hd space on the C:\ drive of the SEP client is less than the configured reserve space for EAR activities, remove unneeded files from C:\ or add free hd space by increasing capacity.