If the files are accumulating in \AgentEvents folder then the issue is with Agent.
What happens when open Agent status monitor and click on tab 'Send Events'? Are you getting any error message?
Can we have agent log from the client machine?
I am not HIPS expert. Someone please confirm if there is any way to limit the events.
The Agent event files are part of the McAfee Framework service (and ePO agent functionality). It is not a good idea to limit the files here, as this may cause issues. It's best to determine why there are so many event files on the system. With the McAfee Agent functionality, these events should be sent to the ePO server on a regular basis. If these events are not being sent up, you'll need to troubleshoot this with our ePO team.
There is no Host IPS functionality to limit these event files.
Thanks for your and Hem responses.
In the Agent Monitor, it seems to be failing to upload to the ePO server for about a third of our machines. Since the ePO server is actually administered by another group I really do not have access to troubleshoot other than at the desktop.
From what these administrators are telling me, we can delete logs greater than 30 days old but, we will have to do it via Safe Mode since our local rights cannot stop some of the client machine services. Is there some way of removing the older files remotely and not have to restart > 100 machines in Safe Mode to free disk space on already aged workstations?