<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">And I forgot to mention I’m using 2.1 beta 2 on CentOS 6.5 with all yum updates (including kernel 2.6).<div class=""><br class=""></div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Dec 17, 2014, at 3:29 PM, Barkley, Joey <<a href="mailto:Joey.Barkley@ingramcontent.com" class="">Joey.Barkley@ingramcontent.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">I’ve built Suricata according to the directions here <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_64_Installation_(with_unix_socket_geoip_profiling_and_MD5_features)" class="">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/CentOS_64_Installation_(with_unix_socket_geoip_profiling_and_MD5_features)</a>.<div class=""><br class=""></div><div class="">Once done, I can get suricata configured with oinkmaster and it starts up. I’m logging to eve.json. I get about a minute’s worth of data and then it just stops. One core of the system is at 100%. RAM usage is at 16GB of 256GB available. System has 32 available cores.</div><div class=""><br class=""></div><div class="">Can anyone help me? I turned off flow and netflow just to make sure those weren’t slowing it down. There appear to be no errors in the suricata.log file.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Joey</div></div>_______________________________________________<br class="">Discussion mailing list<br class=""><a href="mailto:Discussion@lists.openinfosecfoundation.org" class="">Discussion@lists.openinfosecfoundation.org</a><br class="">https://lists.openinfosecfoundation.org/mailman/listinfo/discussion</div></blockquote></div><br class=""></div></body></html>