AnsweredAssumed Answered

ESA 11.3 falling sessions behind

Question asked by Nick Mikhal on Mar 4, 2020
Latest reply on Mar 4, 2020 by Rohit Unnikrishnan



We are experiencing ESA sessions behind with 11.3+ ESA and would like to seek advice of community on how to handle the issue. You can see previous thread covering 10.6 here: ESA Lag - Sessions Behind constantly 
Following RSA guide to reset position tracking does not help (mongo collections do not show up):
Restarting ESA+Concentrators does not help due to high EPS+Backlog, re adding Concentrator as source does not help due to cached position tracking.
Previously you could disable position tracking in case you have huge backlog, but this option is not there in 11.3:

Does anyone know how to disable position tracking in 11.3, or you have to do it via Mongo every time?
Also has anyone tried to force ESA to read historical events not to re-inject them by hand? If you have several ESA's while you reset position on one of them you could read the backlog via forged last sessionid on the second one not to loose historical use case triggers.