I installed suricata on CentOS7, it can work well, but the count of alert in fast.log is incorrect. I made a rules file, it does not use any threshold, and suticata.yaml does not use threshold.config. Ping command executed some times (1 per second, over 60 seconds), but there is only one log in fast.log. Does suricate used a default threshold?
It shouldn’t, can you provide much more details about your setup?