# Flow Emergency Mode entered
**URL:** https://forum.suricata.io/t/flow-emergency-mode-entered/2482
**Category:** Help
**Tags:** suricata
**Created:** [May 9, 2022, 3:09pm UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482 "2022-05-09T15:09:18Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@moe\_m](https://forum.suricata.io/u/moe_m)
#### Post date: [May 9, 2022, 3:09pm UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482/1 "2022-05-09T15:09:18Z")
Hello
I am running Suricata inside latest version of Security Onion
I am getting this repeatedly in suricata.log:
/2022 – 14:56:12 - - Flow emergency mode entered…
/2022 – 15:01:44 - - Flow emergency mode over, back to normal… unsetting FLOW\_EMERGENCY bit (ts.tv\_sec: 1652108504, ts.tv\_usec:453137) flow\_spare\_q status(): 93% flows at the queue
2022 – 15:01:45 - - Flow emergency mode entered…
/2022 – 15:01:52 - - Flow emergency mode over, back to normal… unsetting FLOW\_EMERGENCY bit (ts.tv\_sec: 1652108512, ts.tv\_usec:679172) flow\_spare\_q status(): 77% flows at the queue
Why am I seeing this?
thanks in advance
//
---
### Author:  [@jufajardini](https://forum.suricata.io/u/jufajardini)
#### Post date: [May 9, 2022, 6:09pm UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482/2 "2022-05-09T18:09:44Z")
Hello!
There is some explanation on when Suricata enters flow emergency mode in this section of the user guide: [12.1. Suricata.yaml — Suricata 8.0.0-dev documentation](https://suricata.readthedocs.io/en/latest/configuration/suricata-yaml.html?highlight=flow%20emergency#flow-settings:)
> At the point the memcap will still be reached, despite prealloc, the flow-engine goes into the emergency-mode. In this mode, the engine will make use of shorter time-outs. It lets flows expire in a more aggressive manner so there will be more space for new Flows.
> There are two options: emergency\_recovery and prune\_flows. The emergency recovery is set on 30. This is the percentage of prealloc’d flows after which the flow-engine will be back to normal (when 30 percent of the 10000 flows is completed).
> If during the emergency-mode, the aggressive time-outs do not have the desired result, this option is the final resort. It ends some flows even if they have not reached their time-outs yet. The prune-flows option shows how many flows there will be terminated at each time a new flow is set up.
I hope this helps clarify the matter!
---
### Author:  [@moe\_m](https://forum.suricata.io/u/moe_m)
#### Post date: [May 9, 2022, 8:33pm UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482/3 "2022-05-09T20:33:57Z")
Thanks…
Would increasing the memcap be a safe and effective adjustment? Default is set at 128mb, which sounds like it may be small for a 10gb network.
//
---
### Author:  [@jufajardini](https://forum.suricata.io/u/jufajardini)
#### Post date: [May 9, 2022, 8:51pm UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482/4 "2022-05-09T20:51:15Z")
I’m unfortunately not qualified to properly answer that question, but I suppose that this is also highly dependent on what is your usage scenario for Suri…
---
### Author:  [@syoc](https://forum.suricata.io/u/syoc)
#### Post date: [May 11, 2022, 7:43am UTC](https://forum.suricata.io/t/flow-emergency-mode-entered/2482/5 "2022-05-11T07:43:35Z")
You could easily increase the flow memcap to 1GB if you have the available RAM. Lowering the flow active timeout values should also help.