I am doing a new deployment of Security Analytics which has 4 appliances, a decoder, concentrator, hybrid and SA server with broker. I upgraded the appliances from 10.5 to 10.5.1 then finally to 10.5.1.2. Collection on the decoders stops after about 5 - 10 minutes of service restart. So if I restart the service every 20 minutes I will have data every time. At times collection can start on its own hours later and stop again. I have checked everything. In case you are wondering yes, all services are set to auto start.