Logging level and retention can mess things up. We keep log type = warning, except for Mail Transfer Agent = Information.
Database storage limits are 50 MB and 7 day. Message audit log is enabled and set for 30 days (I think Symantec recommends only 7 days).
The reporting database can really eat disk space as well. We track sender domains, sender IP, recipients domains. We are on SBG 9.01 so we also track recipients and invalid recipients, retention is 45 days (Sym recommends 30 days).
We are on 8380's 830 GB - 4 scanners, 1 dedicated CC, 6 M messages/day.
We do have some 8260's running SBG 9.01. In some versions of SBG, the remote logging didn't work very well, but syslog feature now appears stable, and all the message audit stuff gets written to the syslog box. You could implement that and off load logs if you need to keep more than the 7 days Symantec recommended. SysLog Watcher, Personal Edition will work for testing (only allows a single syslog source).