High number of kernel_drops

[Souji_T (Souji Thenria)]

Hi,
in case you have not solved your problem, this helped me with a similar problem.

Suricata high capture.kernel_drops count

At first, I want to thank everybody who helped me with this problem! If anybody should have a similar problem, here what we did: set cluster-type: to cluster_flow set runmode: to workers activate and configure the cpu-affinity settings In the end what really did the trick I think, was setting mmap-locked: and tpacket-v3: to yes. But in order to use the mmap-locked option you have to edit the /etc/security/limits.conf file and add something like this to the End of the file, otherwise surica…

In short:
I had to uncomment mmap-locked and tpacket-v3 and also change some memory settings so that suricata was able to reserve enough memory.