Flow Emergency Mode entered

Help
1

Hello
I am running Suricata inside latest version of Security Onion

I am getting this repeatedly in suricata.log:

/2022 – 14:56:12 - - Flow emergency mode entered…
/2022 – 15:01:44 - - Flow emergency mode over, back to normal… unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1652108504, ts.tv_usec:453137) flow_spare_q status(): 93% flows at the queue
2022 – 15:01:45 - - Flow emergency mode entered…
/2022 – 15:01:52 - - Flow emergency mode over, back to normal… unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1652108512, ts.tv_usec:679172) flow_spare_q status(): 77% flows at the queue

Why am I seeing this?

thanks in advance
//

2

Hello!

There is some explanation on when Suricata enters flow emergency mode in this section of the user guide: 12.1. Suricata.yaml — Suricata 8.0.0-dev documentation

At the point the memcap will still be reached, despite prealloc, the flow-engine goes into the emergency-mode. In this mode, the engine will make use of shorter time-outs. It lets flows expire in a more aggressive manner so there will be more space for new Flows.
There are two options: emergency_recovery and prune_flows. The emergency recovery is set on 30. This is the percentage of prealloc’d flows after which the flow-engine will be back to normal (when 30 percent of the 10000 flows is completed).
If during the emergency-mode, the aggressive time-outs do not have the desired result, this option is the final resort. It ends some flows even if they have not reached their time-outs yet. The prune-flows option shows how many flows there will be terminated at each time a new flow is set up.

I hope this helps clarify the matter!

1 Like
3

Thanks…

Would increasing the memcap be a safe and effective adjustment? Default is set at 128mb, which sounds like it may be small for a 10gb network.

//

4

I’m unfortunately not qualified to properly answer that question, but I suppose that this is also highly dependent on what is your usage scenario for Suri…

5

You could easily increase the flow memcap to 1GB if you have the available RAM. Lowering the flow active timeout values should also help.

1 Like