The real-time events are compressed on the Agent-side with retention size of 2GB.
On the Agent-side it can be found under this path:
%ADC_INSTALL_PATH%\data\tasks\{GUID}\tpvc\messages.1
On the InTrust server itself, it is located here:
%Propgram Files%\Intrust\SErver\ADC\data\itrtserv\tpvc\messages.1