Suricata 6 --> High CPU usage while mem is good

did you run perf top with the pidof suricata?
I’ve never seen that high mcount symbols anywhere :confused:

You could try cluster_qm as described in 9.5. High Performance Configuration — Suricata 6.0.3 documentation just make sure that every cpu related affinity setting is correct and on the same numa node.