Suricata Service Crashes with "pthread_create() is 11" Error when Processing PCAP with CAPEv2

It looks like pthread_create is returning with a no resource available error. This is mostly likely a system level issue, some hardening perhaps, preventing Suricata from creating processes.

One thing to try is disabling limit-noproc. In your suricata.yaml look for the following:

security:
  # if true, prevents process creation from Suricata by calling
  # setrlimit(RLIMIT_NPROC, 0)
  limit-noproc: true

And set limit-noproc to false and retry again. If this helps, we might be running into a conflict against some local system level hardening and our own attempt at hardening.

Either way, it looks like the kernel is preventing Suricata from creating new processes and threads. Suricata itself doesn’t turn this hardening measure on until all the threads are created.