Thank you @syoc . That’s was I was suspecting, since now I see the swap and also CPU increasing consumption for suricata process.
Current values for Host table are the following:
host:
hash-size: 536870912
prealloc: 131072000
memcap: 2097152mb
After last restart Suricata is not coming up yet (got stuck). I am not an expert, but for me, the above values are huge already. I am not sure if @vjulien agree with me. Current config it is starting to impact the machine performance.
I think I have reached the limit. Perhaps it is time to start trying something different.
Any recommendations @vjulien ? If you need more details, please let me know.
Thank you