1 of 1 people found this helpful
That sounds like you have at least one pattern which is taking a very long time to run. If the engine performance shows few events actually being processed during a scan this would also tend to indicate a pattern issue. Restarting temporarily works around the problem because pq files can be processed in a different order and hence go away until the system tries to run the pattern again.
Regarding taking a long time in the UI, you would need to look at the performance load on the appliances.
We've taken a look at the active patterns and didn't notice anything outright alarming. We noticed that when looking at whole cluster pattern performance, one of our custom patterns has over 27K invocations and a total execution time of 791. Although a little high, this didn't appear to be a cause for concern to support. Anything specific to look for in regards to pattern performance that we may be missing?