ESA 11.3 falling sessions behind

[NickMikhal]

Hello,

We are experiencing ESA sessions behind with 11.3+ ESA and would like to seek advice of community on how to handle the issue. You can see previous thread covering 10.6 here: https://community.rsa.com/message/929061 
Following RSA guide to reset position tracking does not help (mongo collections do not show up): https://community.rsa.com/docs/DOC-106061
Restarting ESA+Concentrators does not help due to high EPS+Backlog, re adding Concentrator as source does not help due to cached position tracking.
Previously you could disable position tracking in case you have huge backlog, but this option is not there in 11.3: https://community.rsa.com/docs/DOC-75214

Does anyone know how to disable position tracking in 11.3, or you have to do it via Mongo every time?
Also has anyone tried to force ESA to read historical events not to re-inject them by hand? If you have several ESA's while you reset position on one of them you could read the backlog via forged last sessionid on the second one not to loose historical use case triggers.

Regards,
Nick

[RohitUnnikrishn]

Hello Nick,

We have identified a few issues in 11.2.x and 11.3.x which impacts ESA deployments and have been fixed in 11.3.2.1+. What I would like to recommend at this point is to ensure that -

1. You are running 11.3.2.1 or higher.
2. Parity across deployments - everything is upgraded to 11.3.2.1 or higher and not running in mix-mode.
3. Check metrics on rules to triage and understand if any are having high cpu utilization.
4. Optimize rules to avoid use of toLowerCase().

We dont have a way to disable position tracking, but we have steps to manipulate position tracking to catch up on backlog, but that would be recommended only after the above steps are completed. If you are still seeing the issue, please contact support and we will be happy to help troubleshoot this further, including assisting you with options to churn through the backlog sessions.

Thank you.

Rohit