Hi everyone, I’m not so new to Suricata, but I have a problem loading rules. I have received more than 2 miles of rules to apply and the time it takes to process them is in hours. When I look at htop, only one core is fully utilized, but Suricata says it has 4 management threads. I am already usin…

The initial rule loading is single-threaded unfortunately. We also noticed this when running >200k rules (and updating them daily). I agree that datasets are the way to go if the rules are autogenerated from a secondary indicator set. Another option, in that case, would be to do downstream matching …

Ruleset loading time

Rules

Luke (Luke D) April 7, 2020, 9:52am 10

Thank you for explanation, I will look on it.

Suricata and IP blacklist

Topic		Replies	Views
Suricata is not running after 260k loaded rules Help suricata	6	410	January 18, 2023
Suricata doesn't work using 100,000 rules Help rules	9	625	March 28, 2023
Long `HOME_NET` list leads to very slow startup times? Help	3	321	March 18, 2023
Suricata losts many packets when no rulesets are loaded	4	242	February 28, 2024
Suricata Rule Tuning Help rules , suricata	4	71	August 19, 2024

Ruleset loading time

Related topics