Suricata 7 Flow emergency mode entered

Help
1

A few times this has shown up on a Suricata 7.0.1 Redhat 8 server with DPDK running:

Oct 5 14:14:14 suricata[4109]: Notice: flow-manager: Flow emergency mode entered… [FlowManager:flow-manager.c:802]
Oct 5 14:14:24 suricata[4109]: Notice: flow-manager: Flow emergency mode over, back to normal… unsetting FLOW_EMERGENCY bit (ts.tv_sec: 1696508064, ts.tv_usec:209211) flow_spare_q status(): 237% flows at the queue [FlowManager:flow-manager.c:868]

Oct 5 14:30:11 suricata[4109]: Notice: flow-manager: Flow emergency mode entered… [FlowManager:flow-manager.c:802]
Oct 5 14:30:11 suricata[4109]: Notice: flow-manager: Flow emergency mode entered… [FlowManager:flow-manager.c:802]

What is the best approach, reducing flowtimeout values or such?

Thanks,
Andre

2

Yes, reducing flow timeouts can be one of the options. The other I can think of is by increasing flow.size to have a larger flow table.

Flow size settings is here: https://github.com/OISF/suricata/blob/master/suricata.yaml.in#L1424

1 Like