<div dir="ltr">I've been playing with various numbers of threads for suricata using afpacket in workers mode. I seem to end up with some number of threads that aren't processing packets, for example when I have 16 threads, I see:<div><br></div><div>15 threads that look like this:<br><div><div>==> /tmp/collectd/csv/host/suricata-AFPacketbond01/suricata_capture-kernel_packets-2015-10-09 <==</div><div>epoch,value</div><div>1444425138.693,2704177</div><div>1444425198.689,5107892</div><div>1444425258.673,7853272</div><div>1444425318.687,9862534</div><div>1444425378.675,12403800</div><div>1444425438.672,15074199</div><div>1444425498.664,18680028</div><div>1444425558.686,22200222</div><div>1444425618.664,25442565</div><div><br></div><div>and one thread that looks like this:</div><div>==> /tmp/collectd/csv/host/suricata-AFPacketbond02/suricata_capture-kernel_packets-2015-10-09 <==</div><div>epoch,value</div><div>1444425138.695,0</div><div>1444425198.689,0</div><div>1444425258.674,0</div><div>1444425318.687,0</div><div>1444425378.676,0</div><div>1444425438.672,0</div><div>1444425498.665,0</div><div>1444425558.686,0</div><div>1444425618.664,0</div></div><div><br></div></div><div>When I bump up to 32 threads (just for testing) I end up with two threads that aren't seeing any packets. Is there any obvious reason for this? Ideas on troubleshooting?</div><div><br></div><div>./d</div></div>