Error: conf: malformed integer value for buffer-size with base 0: '12GB'

Help
1

I want my Suricata to use AF_PACKET and only do the basic TCP connection tracking (stream).
Here is my config:

%YAML 1.1
---

af-packet:
  - interface: ens16
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    mmap-locked: yes
    tpacket-v3: yes
    buffer-size: 12GB
    stream: yes

default-rule-path:

output:
  - console:
      enabled: yes
      format: plain

stream:
  memcap: 12GB
  checksum-validation: no
  inline: no
  depth:
    stream: 0
    inspect: 0
  prealloc-streams: 200000
  log:
    alerts: yes
    dropped: no

tcp:
  max-synack-queued: 5
  midstream: no

unix-command:
  enabled: no

I’m confused by the error when I run suricata -c suricata.yml -i ens16:

Notice: suricata: This is Suricata version 7.0.0-rc1 RELEASE running in SYSTEM mode
Info: cpu: CPUs/cores online: 12
Info: ioctl: ens16: MTU 1500
Info: suricata: No 'host-mode': suricata is in IDS mode, using default setting 'sniffer-only'
Warning: counters: stats are enabled but no loggers are active
Info: detect: No signatures supplied.
Error: conf: malformed integer value for buffer-size with base 0: '12GB'
Info: runmodes: ens16: creating 12 threads
Notice: threads: Threads created -> W: 12 FM: 1 FR: 1   Engine started.

I tried different values but I always go this error. What am I missing?

2

After a short amount of time I also got

Notice: flow-manager: Flow emergency mode entered...
suricata: util-streaming-buffer.c:1406: StreamingBufferInsertAt: Assertion `!(offset + data_len > sb->region.stream_offset + sb->region.buf_offset)' failed.
Aborted
3

Could you try the value being like 12000000 instead of using GB?
Also 12GB as buffer size for the interface seems far off.

For the flow emergency mode → how much traffic is seen?
And how did you build Suricata? (–build-info might help)