Summary
ESM could not receive events from connectors because the activelist got "db % used" at 100%.

Products
ArcSight Enterprise Security Manager (ESM)

Environment
ArcSight ESM - All versions

Situation
EPS goes down 0 about in a week, again and again.
All connectors stop sending events to ESM.

The following message was found in server.std.log.

2022-04-26 14:35:03 WARNING: '1' agent requests REJECTED because the limit of '256' agent threads was exceeded.

The following properties didn't resolve the issue even if agents number is 40.
agents.threads.max=512
servletcontainer.jetty311.threadpool.maximum=1024

And then, the similar to the following was still recorded again in server.std.log.
2022-06-28 18:26:37 WARNING: '1' agent requests REJECTED because the limit of '512' agent threads was exceeded

Read Full Knowledge Base Article for Cause and Resolution Steps. 

URL Name
KM000009459