Flow Emergency Mode entered

Hello
I am running Suricata inside latest version of Security Onion

I am getting this repeatedly in suricata.log:

/2022 – 14:56:12 - - Flow emergency mode entered…
/2022 – 15:01:44 - - Flow emergency mode over, back to normal… unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1652108504, ts.tv_usec:453137) flow_spare_q status(): 93% flows at the queue
2022 – 15:01:45 - - Flow emergency mode entered…
/2022 – 15:01:52 - - Flow emergency mode over, back to normal… unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1652108512, ts.tv_usec:679172) flow_spare_q status(): 77% flows at the queue

Why am I seeing this?

thanks in advance
//

Hello!

There is some explanation on when Suricata enters flow emergency mode in this section of the user guide: 10.1. Suricata.yaml — Suricata 7.0.0-dev documentation

At the point the memcap will still be reached, despite prealloc, the flow-engine goes into the emergency-mode. In this mode, the engine will make use of shorter time-outs. It lets flows expire in a more aggressive manner so there will be more space for new Flows.
There are two options: emergency_recovery and prune_flows. The emergency recovery is set on 30. This is the percentage of prealloc’d flows after which the flow-engine will be back to normal (when 30 percent of the 10000 flows is completed).
If during the emergency-mode, the aggressive time-outs do not have the desired result, this option is the final resort. It ends some flows even if they have not reached their time-outs yet. The prune-flows option shows how many flows there will be terminated at each time a new flow is set up.

I hope this helps clarify the matter!

1 Like

Thanks…

Would increasing the memcap be a safe and effective adjustment? Default is set at 128mb, which sounds like it may be small for a 10gb network.

//

I’m unfortunately not qualified to properly answer that question, but I suppose that this is also highly dependent on what is your usage scenario for Suri…

You could easily increase the flow memcap to 1GB if you have the available RAM. Lowering the flow active timeout values should also help.

1 Like