[AlienVault] "Message reprocess for lock rejection" loop in workers

[dominictory]

Description

Workers are not processing specifically AlienVault bundles where we are seeing the below log looping over and over (count has been seen way higher, in the 100s, however I restart multiple times since):

INFO Importing an object | timestamp=2024-12-18T11:19:19.489271Z name=api taskName=null attributes={"type":"report","id":"report--224fa54d-8392-5219-a48a-759bfb25c9c0"}

INFO Creating External Reference | timestamp=2024-12-18T11:19:19.489803Z name=api taskName=null attributes={"source_name":"AlienVault"}

INFO Creating Report | timestamp=2024-12-18T11:19:19.568699Z name=api taskName=null attributes={"name":"Mirai - C2 IP Addresses"}

INFO Message reprocess for lock rejection | timestamp=2024-12-18T11:19:21.887623Z name=worker taskName=null attributes={"count":4}

Other connectors appear to ingest fine. According to this message, it suggests a resource/heavy load issue, however we have a lot of headroom and I can't see any reason why it would be heavy load when no other connectors' bundles are awaiting processing. Tried adjusting number of workers to no avail.

We have the below platform cluster setup:

1x frontend
1x managers
1x connectors
2x workers (3 workers each)

Environment

6.4.2

Reproducible Steps

Use AlienVault connector
Observe issue?

Expected Output

Workers process bundles

Actual Output

"Message reprocess for lock rejection" loop