ah interesting! yeah I think what i’m experiencing is a little different. first, my et/pro alerts write to neither fast.log nor eve.json - i see in your thread you mention the alerts do show up in eve.json . second, i am able to get alerts to show up in fast.log and eve.json as long as they are from Suricata’s default rulesets, and not an externally loaded ruleset like et/pro or tgreen/hunting. since those alerts do show up, i wouldn’t expect a buffer to be causing the problem. but i will give it a try anyways, definitely doesn’t hurt to test things out and see what happens!