I observed same issue when ESM went faulty and new RMA took some time to install. There were logs in GBs pending for receiver.
That message usually means the receiver is playing catchup because you possibly have one or more datasource(s) hammering the receiver. Log into the receiver and run "cd /var/log/data/inline/thirdparty.logs/" and "ls -ltr" you should see the directories for your datasources. Run "du -shx *" and see if there are any directories with a high volume of data underneath. From there you can find the matching host/IP in "cat /etc/NitroGuard/thirdparty.conf".
Check this thread https://community.mcafee.com/message/369082?tstart=0#369082.
Thx for your replay. I "solved" this problem. I have migrate all Datasource from this ERC with the Failur to another one with no Datasources.
After that i reinstall the ERC with the failur.
I did that what you descripe i had more than 10 machine withe a volume over 4 GB. The support said this is the problem from custom parser but the same Datasources on the other ERC runs without a failur.
But thanks for your help