Use show failover command to troubleshoot your issues. The show failover command displays the dynamic failover information, interface status, and Stateful Failover statistics. The Stateful Failover Logical Update Statistics output appears only when Stateful Failover is enabled. The "xerr" and "rerr" values do not indicate errors in failover, but rather the number of packet transmit or receive errors.
I believe that I have an explanation that comes pretty close. In the figures that are in your original post the total number of IPSec SAs is 1728. When you consider that an IPSec SA is unidirectional there are 2 SAs for each IPSec session. So divide the number of SAs (1728) by 2 and you get 864.
Given the difficulty of truly executing 2 commands at the exact same instant I believe that it is reasonable that 2 sessions may have stopped (or 2 sessions started) between execution of the first command and execution of the second command which would explain the 864 from one command and 862 from the other.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...