It could be like the GROK-lock issues I was seeing - next time it locks up check the process-buffer dump on the node?