Symantec Endpoint Detection and Response allocates 1 GB of disk space for saved reports and regularly monitors this space to ensure that it is not exceeded. This process ensures that the number of saved reports does not grow uncontrollably and consume too much space.
When 90% of this allocation is reached, Symantec EDR generates the following System Needs Attention message in the System Health Indicator in the Symantec EDR console:
Device is encountering high disk space usage by reports
When 100% of this allocation is reached, Symantec EDR generates the following System Is Critical message:
Device encountered maximum disk space usage (1 GB) by reports
When the maximum allocation is reached, Symantec EDR frees up 10 percent of this space by purging saved reports, beginning with the oldest. When Symantec EDR purges a report, the report and all its data are removed from your server. You might want to periodically download older reports before the purge occurs.
Symantec EDR does not purge the reports that are less than 30 days old. If the maximum allocation is reached by reports that are less than 30 days old, you can manually delete the reports that you no longer need. See Deleting generated reports.