Hey All:
I use Surica 7.0.6 and ELK for traffic analysis. I have two network cards and use AF packet capture. My incoming and outgoing packets are not sent through the same network card, so I want to combine the two physical network cards into a logical network card for packet capture. However, the packet loss rate has reached 40%. I have a packet loss rate of about 2% for capturing packets separately from the two network cards. My CPU48 core, intel xeon silver 4214 cpu 2.2GHz， Memory 512GB, network card X710, server performance not fully utilized.
Is there any good way to optimize it?
Thank you.
My traffic on a single network card is 4.5Gbps and 4.5Gbps, respectively. After forming a logical network card, it is 7 to 8Gbps, which is not peak traffic. Peak traffic can reach 12Gbps