# Suricata high capture.kernel\_drops count

**URL:** https://forum.suricata.io/t/suricata-high-capture-kernel-drops-count/465
**Category:** Help
**Created:** [August 4, 2020, 7:08am UTC](https://forum.suricata.io/t/suricata-high-capture-kernel-drops-count/465 "2020-08-04T07:08:07Z")
**Posts on this page:** 1
**Showing post:** 24

<div class="post-metadata">

### Author: ![Souji\_T](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/souji_t/32/2633_2.png) [@Souji\_T](https://forum.suricata.io/u/Souji_T)
#### Post date: [September 10, 2020, 9:17am UTC](https://forum.suricata.io/t/suricata-high-capture-kernel-drops-count/465/24 "2020-09-10T09:17:35Z")

</div>

At first, I want to thank everybody who helped me with this problem!

If anybody should have a similar problem, here what we did:

- set `cluster-type:` to `cluster_flow`
- set `runmode:` to `workers`
- activate and configure the `cpu-affinity` settings  
In the end what really did the trick I think, was setting `mmap-locked:` and `tpacket-v3:` to `yes`. But in order to use the `mmap-locked` option you have to edit the `/etc/security/limits.conf` file and add something like this to the End of the file, otherwise suricata will fail because it can’t lock enough memory:

> suricata hard memlock unlimited  
> suricata soft memlock unlimited

Additional if you start suricata as Service you have to add `LimitMEMLOCK=infinity` to the `suricata.service` file.  
You can read more about it here: [Bug #2918: Unable to mmap, error Resource temporarily unavailable - err seems OS specific - Suricata - Open Information Security Foundation](https://redmine.openinfosecfoundation.org/issues/2918)

---

_[View the full topic](https://forum.suricata.io/t/suricata-high-capture-kernel-drops-count/465)._