Enterprise Vault has a number of protection mechanisms in place for when resources run low on the server where it is running. The main ones are protection against lack of disk space, and protection from low available memory.
By default Enterprise Vault will shut down if 95% or more virtual memory is used, or if the local drives on the EV server are 99% full.
The Enterprise Vault Admin Service is responsible for monitoring this, when it detects a problem it will log an event such as this one:
Event Type: Error
Event Source: Enterprise Vault
Event Category: Admin Service
Event ID: 4141
Date: 4/1/2010
Time: 2:50:46 AM
Computer: EVSERVER1
Description:
Insufficient diskspace is available on drive C: for the Enterprise Vault to run
Enterprise Vault will now be shut down; to correct this problem, delete any unwanted files and restart Enterprise Vault.
It is possible to change how Enterprise Vault handles these type of situations, and you can even stop monitoring specific disks. Take a look at the Technote which describes the possibilities in more detail.
Reference:
http://www.symantec.com/business/support/index?page=content&id=TECH48953