Suricata high capture.kernel_drops count

Help
24

At first, I want to thank everybody who helped me with this problem!

If anybody should have a similar problem, here what we did:

  • set cluster-type: to cluster_flow
  • set runmode: to workers
  • activate and configure the cpu-affinity settings
    In the end what really did the trick I think, was setting mmap-locked: and tpacket-v3: to yes. But in order to use the mmap-locked option you have to edit the /etc/security/limits.conf file and add something like this to the End of the file, otherwise suricata will fail because it can’t lock enough memory:

suricata hard memlock unlimited
suricata soft memlock unlimited

Additional if you start suricata as Service you have to add LimitMEMLOCK=infinity to the suricata.service file.
You can read more about it here: Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific - Suricata - Open Information Security Foundation

1 Like