This article explains how the aggregation buffer works and what size it is in memory
When buffer is full typical error message would be:
WARN 2011-07-15 15:56:08,255 Collectors.9525.aggregator.AggregatorCacheImpl.CacheSpecEntry AggregatorQueueThread BUFFER SPEC-ID: Aggregator-spec:0 OVERFLOW, size: 98416299 bytes + NEW ENTRY SIZE ( 33011) > 98428518 bytes.
This error occurs when the buffer that is in memory only is full. one possible solution is to reduce the times of the "Aggregation time (ms)" so less event are attached together.
The size od the aggration buffer is fixed and can't be changed. This size is based on the memory allocated to the agent java heap.
By default agent use 512 Mb of RAM, the buffer will use up to 20% of this memory. (approx 100Mb).
If you want to change the -XMX setting from the ses_work.properties file you can go to this article. (Do not change this on the SSIM Appliance itself.)