Hello,<div>I was reading through: <a href="https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Statistics" target="_blank">https://redmine.openinfosecfoundation.org/projects/suricata/wiki/Statistics</a></div><div>
to help me digest what i'm seeing in stats.log. <br>
<br>Some concerning values i'm seeing (bold). I'm not sure if these values are something to be concerned about. On exit I don't appear to be dropping packets.<br><br>Counter | TM Name | Value<br>
-------------------------------------------------------------------<br>tcp.sessions | Detect | 12565818<br><b>tcp.ssn_memcap_drop | Detect | 7176515</b><br>tcp.pseudo | Detect | 371830<br>
tcp.invalid_checksum | Detect | 0<br>tcp.no_flow | Detect | 0<br>tcp.reused_ssn | Detect | 7<br>tcp.memuse | Detect | 289406976<br>
tcp.syn | Detect | 19778120<br>tcp.synack | Detect | 9945438<br>tcp.rst | Detect | 2156671<br><b>tcp.segment_memcap_drop | Detect | 47685491</b><br>
<b>tcp.stream_depth_reached | Detect | 621</b><br>tcp.reassembly_memuse | Detect | 6442450854<br><b>tcp.reassembly_gap | Detect | 1080680</b><div><b><br>
</b></div><div>When I close suricata the packet loss seems fine - <br>[2381] 7/6/2012 -- 15:44:16 - (source-pfring.c:446) <Info> (ReceivePfringThreadExitStats) -- (RxPFR1) Pfring Total:814218358 Recv:813945791 Drop:272567 (0.0%).</div>
<div><br></div><div>The box is a dualsocket dualcore with 8GB of ram. I see anywhere from 150mb/s-350mb/s depending on the time of day. I've seen the box reach about 4GB of ram at its max and suricata I've seen reach about 250% cpu (2.5 cores), but it typically stays around 50-150% and 2-3GB of ram. I'm running a ruleset of ~ 12k rules</div>
<div><br></div><div>Here are what appear to be the relevant lines from suricata.yaml</div><div><br></div><div>max-pending-packets: 10000</div><div><br></div><div><div>- file-store:</div><div> enabled: yes # set to yes to enable</div>
<div> log-dir: files # directory to store the files</div><div> force-magic: yes # force logging magic on all stored files</div><div> force-md5: yes # force logging of md5 checksums</div><div> #waldo: file.waldo # waldo file to store the file_id across runs</div>
<div><br></div><div> # output module to log files tracked in a easily parsable json format</div><div> - file-log:</div><div> enabled: yes</div><div> filename: files-json.log</div><div> append: yes</div><div>
#filetype: regular # 'regular', 'unix_stream' or 'unix_dgram'</div><div><br></div><div> force-magic: yes # force logging magic on all logged files</div><div> force-md5: yes # force logging of md5 checksums</div>
</div><div><div>pattern-matcher:</div><div> - b2gc:</div><div> search-algo: B2gSearchBNDMq</div><div> hash-size: low</div><div> bf-size: medium</div><div> - b2gm:</div><div> search-algo: B2gSearchBNDMq</div>
<div> hash-size: low</div><div> bf-size: medium</div><div> - b2g:</div><div> search-algo: B2gSearchBNDMq</div><div> hash-size: low</div><div> bf-size: medium</div><div> - b3g:</div><div> search-algo: B3gSearchBNDMq</div>
<div> hash-size: low</div><div> bf-size: medium</div><div> - wumanber:</div><div> hash-size: low</div><div> bf-size: medium</div><div><br></div><div># Defrag settings:</div><div><br></div><div>defrag:</div>
<div> max-frags: 65535</div><div> prealloc: yes</div><div> timeout: 60</div><div><br></div></div><div><div>flow:</div><div> memcap: 3048mb</div><div> hash-size: 65536</div><div> prealloc: 10000</div><div> emergency-recovery: 30</div>
<div> prune-flows: 5</div></div><div><br></div><div><div>flow-timeouts:</div><div><br></div><div> default:</div><div> new: 30</div><div> established: 300</div><div> closed: 0</div><div> emergency-new: 10</div>
<div> emergency-established: 100</div><div> emergency-closed: 0</div><div> tcp:</div><div> new: 60</div><div> established: 3600</div><div> closed: 120</div><div> emergency-new: 10</div><div> emergency-established: 300</div>
<div> emergency-closed: 20</div><div> udp:</div><div> new: 30</div><div> established: 300</div><div> emergency-new: 10</div><div> emergency-established: 100</div><div> icmp:</div><div> new: 30</div><div>
established: 300</div><div> emergency-new: 10</div><div> emergency-established: 100</div></div><div><br></div><div><div>stream:</div><div> memcap: 3048mb</div><div> checksum-validation: no # reject wrong csums</div>
<div> inline: no # no inline mode</div><div> reassembly:</div><div> memcap: 1024mb</div><div> depth: 1mb # reassemble 1mb into a stream</div><div> toserver-chunk-size: 2560</div>
<div> toclient-chunk-size: 2560</div><div><br></div><div># Host table:</div><div>#</div><div># Host table is used by tagging and per host thresholding subsystems.</div><div>#</div><div>host:</div><div> hash-size: 4096</div>
<div> prealloc: 1000</div><div> memcap: 16777216</div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><div><br></div></div><div><br></div><div>Thank you!</div><div><br></div><div><br></div></div>