It looks like pthread_create
is returning with a no resource available error. This is mostly likely a system level issue, some hardening perhaps, preventing Suricata from creating processes.
One thing to try is disabling limit-noproc
. In your suricata.yaml
look for the following:
security:
# if true, prevents process creation from Suricata by calling
# setrlimit(RLIMIT_NPROC, 0)
limit-noproc: true
And set limit-noproc
to false and retry again. If this helps, we might be running into a conflict against some local system level hardening and our own attempt at hardening.
Either way, it looks like the kernel is preventing Suricata from creating new processes and threads. Suricata itself doesn’t turn this hardening measure on until all the threads are created.