Suricata and IP blacklist

Thank you @syoc . That’s was I was suspecting, since now I see the swap and also CPU increasing consumption for suricata process.

Current values for Host table are the following:

host:
  hash-size: 536870912
  prealloc: 131072000
  memcap: 2097152mb

After last restart Suricata is not coming up yet (got stuck). I am not an expert, but for me, the above values are huge already. I am not sure if @vjulien agree with me. Current config it is starting to impact the machine performance.

I think I have reached the limit. Perhaps it is time to start trying something different.

Any recommendations @vjulien ? If you need more details, please let me know.

Thank you