CPU affinity with

[UPPERCASE]

@lukashino

In case you have multiple NICs on the system laid on throughout the system, then assigning threads to multiple NICs per NUMA-node is not supported at the moment.

Interesting, the documentation seems to point at this possibility, right?

@lukashino

You can start 2 (multiple) processes of Suricata

I have 2 NICs and 2 NUMA nodes, it would be cool to make use of NUMA locality to increase performance. If the documented threads per NIC is not that great or supported, then I’ll check to run multiple processes.

Usually this is supported with systemd, by providing an argument to load a custom config file and orchestrate this: Manage multiple service instances with systemctl | Opensource.com

I don’t see this in the systemd unit from Suricata. Do I have to create a systemd override file to load this custom config myself? That would work too, but it’s less pretty. So, something like this then?

How to Make multiple Instances of suricata in a single machiine

You can run multiple instances of Suricata on a single machine if you’d like. Both the configuration file and the logging directory can be set on the command line: suricata -c /path/to/configuration-file -l /path/to/logging-directory You can also specify the NIC interface: suricata -c /path/to/configuration-file -l /path/to/logging-directory --af-packet=enp3s0 Section 10.4 is for Suricata’s multi-tenancy support. What commands aren’t working as expected?