Collector behavior during device discovery

[RSAAdmin]

Hello, everyone. My organization is seeing some odd behavior in our 4.0 SP3 LS deployment (1 LC, 1 D-SRV, 1 A-SRV). It looks like every time the collector service decides to try to categorize a new/unknown event source, it stops processing all other event sources and queues up the events while it waits for up to five minutes to make a decision on a new event source. Once the new event source is categorized, the collector service releases the event queue, blowing our EPS off the charts and dumping huge number of events on the floor. We have an active case with support and the initial conversation seems to indicate that this is typical/expected behavior. I can't wrap my head around that a random bit of syslog spam would cause an LC to try to buffer up a multi-thousand EPS flow and spend all its time categorizing this one device. Have other encountered this sort of behavior? Thanks for the help!

[RSAAdmin]

We've confirmed with support that new device discovery does indeed suck all of the collector's attention away, allowing events to queue up and then overload enVision once discovery completes. This seems like an unbelievably limited design, that detecting a new device can stop all other event processing for several minutes.

What do other sites do as a good/best practice for device discovery? Turn off auto-discovery and manually add them? I'm concerned that a process failure may cause a device to not get added into enVision, which would ordinarily at least have a chance of auto-discovery catch the system.

David