Suricata quickly consumes all available RAM

Help
1

Running suricata 5.0.3 on pfSense 2.4.5-RELEASE-p1. Just recently we’ve seen one of our suricata instances (sometime LAN sometimes VPN client) quickly consume all RAM and swap until it is killed:
2020-11-11T10:53:14-08:00 firewall kernel: swap_pager_getswapspace(32): failed
2020-11-11T10:53:14-08:00 firewall kernel: swap_pager_getswapspace(32): failed
2020-11-11T10:58:22-08:00 firewall kernel: pid 88575 (suricata), jid 0, uid 0, was killed: out of swap space

RAM
RAM1552×574 48.6 KB

Just noticed an update for 5.0.4 so am trying that.

Any ideas of what else to check for? Thanks.

2

Saw it again with 5.0.4.

3

Can you try 6.0.1 and see if there is a difference?
But might be something specific to PFSense

4

Could you share additional information and perhaps your Suricata configuration file (suricata.yaml) – feel free to redact/omit parts that are sensitive or you don’t want to share.

Information about the traffic and deployment could be helpful. Is Suricata seeing both sides of the communication?

Are there any elephant flows? Any other contextual information could be helpful.