Yesterday, I had 54,356,578 log events captured. I don't think that's too high on 150+ servers, but then again, I'm new at LEM. I did check the default and NATO rules and they are all turned off. I only have about 20 rules enabled right now. I'm wondering what other factors it could be. Could it be too many alerts in queue on the appliance itself? Here's my diskusage from the CMC interface.
Thanks