The max queue size is what controls how many events we will hold in the queue before dropping events. This is in environments where there is a heavy EPS count. When you have situations where your getting close to the threshold of your EPS capabilities, you can open the max queue size to accomodate the overflow traffic. As to what the max number is? I'm not sure, it depends on the environment. You shouldn't mess with this option though if you are not experiencing any issues.

The environment I'm working at have approx. 1300 EPS and 2800 EPS peaks. However it might increase. Also, we are trying to configure a collector that should hold events for more or less a day if the system crashes, which implies it should at least hold 1GB size queue (the maximum value specify in documentation).
I've been testing the agent with a syslog event generator (with 5000 EPS) and a cisco pix collector, and the results for the 2 parameters configuration values have been:

MaxQueueSize  -   80.000     -     980.000     -    980.000
FileSize               -   11.600    -     11.600        -    111.600
Total MB              -   66            -     201              -    224
Number of files  -                   -     18                 -   2

Total MB shows the total queue files size when the collector generates a log message to indicate that it can hold no more events because the queue is full, and since the queue stops growing. Shouldn't it reach 980Mb approx. even though it starts dropping events at some point??

Thank you.
 

here is a good article on queue sizing...

http://service1.symantec.com/support/ent-gate.nsf/...