Have an issue where suricata does not always cleanly recover from memory pressure on the instance
suricata is installed on a number of internet facing hosts in doing ips
we have an overnight memory scan (at approx 02:30 UTC) that runs on the aws instances running suricata
when this runs it does not use all the available RAM but it does cause the ubuntu 18.04 linux kernel to move some of the suricata RSS memory to swap (so the RSS memory usage goes from 250Mb down to approx 50Mb)
this will then recover and suricata will move its RSS back up to 250Mb and work normally when traffic picks up in the mornings. However after a number of days of this suricata will sometimes stop processing traffic and the websites will be unavailable.
sometimes suricata will resolve and work - other times we will see issues later in the day where suricata will stop any pass through
there are no log messages in suricata.log / drop.log / fast.log
A stop / start of suricata will not always clear this issue either - which seems odd.
I have to restart the instance for the issue to be resolved - which then leads to the cycle above
wondering if anyone else has seen this before I raise it as a bug