Meaning of values of additional memcap stats (http.byterange, ippair, host) in suricata 8

1

Since I switched to suricata 8, I observe non-zero values for

stats.http.byterange.memcap

stats.ippair.memcap

stats.host.memcap

It seems, these counters were at least not visible in the stats for suricata 7.

When I set the according config values (http.byterange.memcap, ippair.memcap, host.memcap) to reasonably high values, I still obtain positive statistics values for them.

Do they have a different meaning than all the other memcap hits (which are zero in my case)?

Thx, Maja

2

`stats.http.byterange.memcap` is not the number of times the memcap is hit, it is the memcap itself apparently

Is this consistent with what you see ?

3

Possible. Currently I have not set the byterange memcap value explicitly.

    "http": {
      "memuse": 379231501,
      "memcap": 0,
      "byterange": {
        "memuse": 104847962,
        "memcap": 104857600
      }
    },