How to resolve one CPU usage 100% when running suricata

Please help me.
I’ve setup suricata on debian 10 with 24cores, 24GB RAM for 5Gbps Flow.
It’s running ok but I see more kernel drops in stats log.
When I using htop to monitor resource, as you can see CPU 16 is always high and hit 100% usage and others not.
What happen in my case, and how to resolve this.
I’ll give more information if you need

sorry for my English

There are threads using CPU 16 include kernel process.
But I’ve already disable using CPU 16 in suricata settings like this

- management-cpu-set:

    cpu: [ 0, 1, 2 ]  # include only these CPUs in affinity settings

- receive-cpu-set:

    cpu: [ 0, 1, 2 ]  # include only these CPUs in affinity settings

- worker-cpu-set:

    cpu: [ "2-15","18-23" ]

    mode: "exclusive"

    # Use explicitly 3 threads and don't compute number by using

    # detect-thread-ratio variable:

    # threads: 3


      low: [ 0 ]

      medium: [ "1-2" ]

      high: [ 3 ]

      default: "medium"

#- verdict-cpu-set:

#    cpu: [ 0 ]

#    prio:

#      default: "high"

Hi, Thanks for posting your concern.

Note that htop numbers CPU cores starting at 1 – there’s an htop option for starting the numbering at 0

Also, it’d be helpful to see the thread names in htop – to do this, start htop and then press H while it’s displaying information.

Suricata’s heavily multi-threaded, and using H will display the thread names instead of the commandline used to start the process.

Can you also share Suricata version and the whole config (remove sensitive parts).
Also the NIC and how you configured it.
This looks like a balancing issue but can also be just some elephant flows.