It looks like you have a lot of syslog traffic on the LEM. Can you run a CHECKLOGS under the APPLIANCE menu and see what that returns? What are the log file sizes?
And you may want to run those commands I recommended before:
SETLOGROTATE --> Change to hourly
LIMITSYSLOG --> Change to 24