<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>I've made all of these changes that you've recommended. It didnt help. I've also increased from 2 threads to 4 which helped. I have 4 logical CPUs in total.<div><div>detect:</div><div> profile: custom</div><div> custom-values:</div><div> toclient-groups: 500</div><div> toserver-groups: 600</div><div><br></div><div> sgh-mpm-context: full</div><div> inspection-recursion-limit: 3000</div><div><br></div><div><br></div><div>It took longer to start the service (about 3 minutes instead of 30 seconds). In the past changing sgh-mpm-context to full made suricata try to start forever (probably due to number of rules we have).</div><div><br></div><div>so with these changes and increasing threads from 2 to 4, packet loss is 26%</div><br><div>> Date: Thu, 31 Mar 2016 15:24:44 +0200<br>> Subject: Re: [Oisf-users] troubleshooting packet loss<br>> From: petermanev@gmail.com<br>> To: coolyasha@hotmail.com<br>> CC: oisf-users@lists.openinfosecfoundation.org<br>> <br>> On Thu, Mar 31, 2016 at 3:16 PM, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> > detect:<br>> > - profile: medium<br>> > - custom-values:<br>> > toclient-groups: 3<br>> > toserver-groups: 25<br>> ><br>> > - sgh-mpm-context: auto<br>> > - inspection-recursion-limit: 3000<br>> <br>> You should follow the standard here -<br>> https://github.com/inliniac/suricata/blob/dev-detect-grouping-v193/suricata.yaml.in#L594<br>> Notice that you have "-" in "- profile: medium".... it should be<br>> "profile: custom" ...etc.<br>> <br>> Then just increase the groups numbers to 500/600 for example and use<br>> "sgh-mpm-context: full"<br>> <br>> Make sure it reflects that correctly while loading in suricata.log<br>> using the "-v" switch.<br>> <br>> ><br>> ><br>> >> Date: Thu, 31 Mar 2016 15:03:07 +0200<br>> ><br>> >> Subject: Re: [Oisf-users] troubleshooting packet loss<br>> >> From: petermanev@gmail.com<br>> >> To: coolyasha@hotmail.com<br>> >> CC: oisf-users@lists.openinfosecfoundation.org<br>> >><br>> >> On Thu, Mar 31, 2016 at 3:01 PM, Yasha Zislin <coolyasha@hotmail.com><br>> >> wrote:<br>> >> ><br>> >> > Peter,<br>> >> ><br>> >> > max_packets is set to 65000.<br>> >> ><br>> >> > So I've set my detect-engine to profile medium and default groups like<br>> >> > in your documentation.<br>> >><br>> >> Can you please paste that section here?<br>> >><br>> >> > Packet loss from the start is 96%<br>> >> ><br>> >> > ________________________________<br>> >> > CC: oisf-users@lists.openinfosecfoundation.org<br>> >> > From: petermanev@gmail.com<br>> >> > Subject: Re: [Oisf-users] troubleshooting packet loss<br>> >> > Date: Mon, 28 Mar 2016 19:40:50 +0200<br>> >> ><br>> >> > To: coolyasha@hotmail.com<br>> >> ><br>> >> ><br>> >> > On 28 mars 2016, at 19:19, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> >> ><br>> >> > detect-engine:<br>> >> > - profile: custom<br>> >> > - custom-values:<br>> >> > toclient-src-groups: 200<br>> >> > toclient-dst-groups: 200<br>> >> > toclient-sp-groups: 200<br>> >> > toclient-dp-groups: 300<br>> >> > toserver-src-groups: 200<br>> >> > toserver-dst-groups: 400<br>> >> > toserver-sp-groups: 200<br>> >> > toserver-dp-groups: 250<br>> >> > - sgh-mpm-context: auto<br>> >> > - inspection-recursion-limit: 3000<br>> >> > # When rule-reload is enabled, sending a USR2 signal to the Suricata<br>> >> > process<br>> >> > # will trigger a live rule reload. Experimental feature, use with care.<br>> >> > - rule-reload: true<br>> >> ><br>> >> ><br>> >> > Can you please try adjusting the settings (including the yaml section<br>> >> > itself) as per the link and recommendations I have mentioned in my previous<br>> >> > mail.<br>> >> > The above quoted part of your suricata.yaml section do not follow the<br>> >> > dev-detect-grouping standard/change.<br>> >> ><br>> >> > For pf_ring, I am using 6.3.0. On this specific sensor, I only have one<br>> >> > interface.<br>> >> > Here is suricata.yaml config.<br>> >> > - interface: bond0<br>> >> > # Number of receive threads (>1 will enable experimental flow pinned<br>> >> > # runmode)<br>> >> > threads: 2<br>> >> ><br>> >> > # Default clusterid. PF_RING will load balance packets based on flow.<br>> >> > # All threads/processes that will participate need to have the same<br>> >> > # clusterid.<br>> >> > cluster-id: 99<br>> >> ><br>> >> > # Default PF_RING cluster type. PF_RING can load balance per flow or per<br>> >> > hash.<br>> >> > # This is only supported in versions of PF_RING > 4.1.1.<br>> >> > cluster-type: cluster_flow<br>> >> ><br>> >> ><br>> >> > What is the max pending packets value you have in yaml ?<br>> >> ><br>> >> > Thanks<br>> >> ><br>> >> > Here are pf_ring settings that I use in startup script.<br>> >> ><br>> >> > ethtool -K bond0 rx off<br>> >> > ethtool -K bond0 tx off<br>> >> > ethtool -K bond0 gso off<br>> >> > ethtool -K bond0 gro off<br>> >> ><br>> >> > ethtool -C bond0 rx-usecs 500<br>> >> > ethtool -G bond0 rx 4078<br>> >> ><br>> >> > ifconfig bond0 promisc<br>> >> ><br>> >> > rmmod pf_ring<br>> >> > modprobe pf_ring transparent_mode=0 min_num_slots=65576<br>> >> > enable_tx_capture=0<br>> >> ><br>> >> > ________________________________<br>> >> > CC: oisf-users@lists.openinfosecfoundation.org<br>> >> > From: petermanev@gmail.com<br>> >> > Subject: Re: [Oisf-users] troubleshooting packet loss<br>> >> > Date: Mon, 28 Mar 2016 18:47:56 +0200<br>> >> > To: coolyasha@hotmail.com<br>> >> ><br>> >> ><br>> >> > On 28 mars 2016, at 14:30, Yasha Zislin <coolyasha@hotmail.com> wrote:<br>> >> ><br>> >> > I have about 2 million packets traversing per minute over 10 gig<br>> >> ><br>> >> > pipe. Averaging about 500mbits in traffic.<br>> >> ><br>> >> > Traffic is mostly LDAP, NTP, Syslog. Not really much of HTTP/S.<br>> >> ><br>> >> > That packet loss starts instantly. In a few minutes, you would see it.<br>> >> > After leaving it running over the weekend, I have 19% packet loss.<br>> >> ><br>> >> > BTW, I am using dev v190 branch for this already.<br>> >> ><br>> >> ><br>> >> > What does your "detect:" section look like in suricata.yaml?<br>> >> ><br>> >> > You can use the section here as a reference -<br>> >> ><br>> >> > https://github.com/inliniac/suricata/blob/dev-detect-grouping-v193/suricata.yaml.in#L594<br>> >> > (Please note the naming and spacing)<br>> >> ><br>> >> ><br>> >> > Are you pfring buffers full ? (Or how are they configured )<br>> >> > How does the config section look like for pfring for the two interfaces<br>> >> > you have?<br>> >> ><br>> >> ><br>> >> ><br>> >> > Thanks.<br>> >> ><br>> >> > > Date: Sun, 27 Mar 2016 12:00:22 +0200<br>> >> > > Subject: Re: [Oisf-users] troubleshooting packet loss<br>> >> > > From: petermanev@gmail.com<br>> >> > > To: coolyasha@hotmail.com<br>> >> > > CC: oisf-users@lists.openinfosecfoundation.org<br>> >> > ><br>> >> > > On Thu, Mar 24, 2016 at 7:02 PM, Yasha Zislin <coolyasha@hotmail.com><br>> >> > > wrote:<br>> >> > > > I am trying to figure out where the packet loss is coming from on<br>> >> > > > one of my<br>> >> > > > Suricata 3.0 sensor.<br>> >> > > > The only thing that I see weird from stats.log is that<br>> >> > > > tpc.stream_depth_reached and tcp.reassembly_gap is somewhat high.<br>> >> > > > I am using latest PF_RING and monitoring one interface with 4<br>> >> > > > threads.<br>> >> > > > 4 logical CPUs with 16 gigs of RAM. 66% of RAM is used.<br>> >> > ><br>> >> > > What traffic speeds are those on? How many rules do you load?<br>> >> > ><br>> >> > > On the first interface there is 6.5% loss on the second 3.67% - over<br>> >> > > what period of time was that?<br>> >> > ><br>> >> > > ><br>> >> > > > Here is stats.log info.<br>> >> > > ><br>> >> > > > Thank you<br>> >> > > ><br>> >> > > > capture.kernel_packets | RxPFRbond01 | 34118172<br>> >> > > > capture.kernel_drops | RxPFRbond01 | 2240130<br>> >> > > > decoder.pkts | RxPFRbond01 | 34125944<br>> >> > > > decoder.bytes | RxPFRbond01 | 26624108366<br>> >> > > > decoder.invalid | RxPFRbond01 | 0<br>> >> > > > decoder.ipv4 | RxPFRbond01 | 34707873<br>> >> > > > decoder.ipv6 | RxPFRbond01 | 570<br>> >> > > > decoder.ethernet | RxPFRbond01 | 34125944<br>> >> > > > decoder.raw | RxPFRbond01 | 0<br>> >> > > > decoder.null | RxPFRbond01 | 0<br>> >> > > > decoder.sll | RxPFRbond01 | 0<br>> >> > > > decoder.tcp | RxPFRbond01 | 23715873<br>> >> > > > decoder.udp | RxPFRbond01 | 9702569<br>> >> > > > decoder.sctp | RxPFRbond01 | 0<br>> >> > > > decoder.icmpv4 | RxPFRbond01 | 98456<br>> >> > > > decoder.icmpv6 | RxPFRbond01 | 0<br>> >> > > > decoder.ppp | RxPFRbond01 | 0<br>> >> > > > decoder.pppoe | RxPFRbond01 | 0<br>> >> > > > decoder.gre | RxPFRbond01 | 0<br>> >> > > > decoder.vlan | RxPFRbond01 | 0<br>> >> > > > decoder.vlan_qinq | RxPFRbond01 | 0<br>> >> > > > decoder.teredo | RxPFRbond01 | 570<br>> >> > > > decoder.ipv4_in_ipv6 | RxPFRbond01 | 0<br>> >> > > > decoder.ipv6_in_ipv6 | RxPFRbond01 | 0<br>> >> > > > decoder.mpls | RxPFRbond01 | 0<br>> >> > > > decoder.avg_pkt_size | RxPFRbond01 | 780<br>> >> > > > decoder.max_pkt_size | RxPFRbond01 | 1514<br>> >> > > > decoder.erspan | RxPFRbond01 | 0<br>> >> > > > flow.memcap | RxPFRbond01 | 0<br>> >> > > > defrag.ipv4.fragments | RxPFRbond01 | 1190975<br>> >> > > > defrag.ipv4.reassembled | RxPFRbond01 | 592903<br>> >> > > > defrag.ipv4.timeouts | RxPFRbond01 | 0<br>> >> > > > defrag.ipv6.fragments | RxPFRbond01 | 0<br>> >> > > > defrag.ipv6.reassembled | RxPFRbond01 | 0<br>> >> > > > defrag.ipv6.timeouts | RxPFRbond01 | 0<br>> >> > > > defrag.max_frag_hits | RxPFRbond01 | 0<br>> >> > > > tcp.sessions | RxPFRbond01 | 169101<br>> >> > > > tcp.ssn_memcap_drop | RxPFRbond01 | 0<br>> >> > > > tcp.pseudo | RxPFRbond01 | 77497<br>> >> > > > tcp.pseudo_failed | RxPFRbond01 | 0<br>> >> > > > tcp.invalid_checksum | RxPFRbond01 | 0<br>> >> > > > tcp.no_flow | RxPFRbond01 | 0<br>> >> > > > tcp.syn | RxPFRbond01 | 180407<br>> >> > > > tcp.synack | RxPFRbond01 | 146913<br>> >> > > > tcp.rst | RxPFRbond01 | 138896<br>> >> > > > tcp.segment_memcap_drop | RxPFRbond01 | 0<br>> >> > > > tcp.stream_depth_reached | RxPFRbond01 | 107<br>> >> > > > tcp.reassembly_gap | RxPFRbond01 | 6765<br>> >> > > > detect.alert | RxPFRbond01 | 3426<br>> >> > > > capture.kernel_packets | RxPFRbond02 | 33927252<br>> >> > > > capture.kernel_drops | RxPFRbond02 | 1246692<br>> >> > > > decoder.pkts | RxPFRbond02 | 33932611<br>> >> > > > decoder.bytes | RxPFRbond02 | 25571688366<br>> >> > > > decoder.invalid | RxPFRbond02 | 0<br>> >> > > > decoder.ipv4 | RxPFRbond02 | 34483004<br>> >> > > > decoder.ipv6 | RxPFRbond02 | 506<br>> >> > > > decoder.ethernet | RxPFRbond02 | 33932611<br>> >> > > > decoder.raw | RxPFRbond02 | 0<br>> >> > > > decoder.null | RxPFRbond02 | 0<br>> >> > > > decoder.sll | RxPFRbond02 | 0<br>> >> > > > decoder.tcp | RxPFRbond02 | 24665968<br>> >> > > > decoder.udp | RxPFRbond02 | 8600129<br>> >> > > > decoder.sctp | RxPFRbond02 | 0<br>> >> > > > decoder.icmpv4 | RxPFRbond02 | 113797<br>> >> > > > decoder.icmpv6 | RxPFRbond02 | 0<br>> >> > > > decoder.ppp | RxPFRbond02 | 0<br>> >> > > > decoder.pppoe | RxPFRbond02 | 0<br>> >> > > > decoder.gre | RxPFRbond02 | 0<br>> >> > > > decoder.vlan | RxPFRbond02 | 0<br>> >> > > > decoder.vlan_qinq | RxPFRbond02 | 0<br>> >> > > > decoder.teredo | RxPFRbond02 | 506<br>> >> > > > decoder.ipv4_in_ipv6 | RxPFRbond02 | 0<br>> >> > > > decoder.ipv6_in_ipv6 | RxPFRbond02 | 0<br>> >> > > > decoder.mpls | RxPFRbond02 | 0<br>> >> > > > decoder.avg_pkt_size | RxPFRbond02 | 753<br>> >> > > > decoder.max_pkt_size | RxPFRbond02 | 1514<br>> >> > > > decoder.erspan | RxPFRbond02 | 0<br>> >> > > > flow.memcap | RxPFRbond02 | 0<br>> >> > > > defrag.ipv4.fragments | RxPFRbond02 | 1103110<br>> >> > > > defrag.ipv4.reassembled | RxPFRbond02 | 550393<br>> >> > > > defrag.ipv4.timeouts | RxPFRbond02 | 0<br>> >> > > > defrag.ipv6.fragments | RxPFRbond02 | 0<br>> >> > > > defrag.ipv6.reassembled | RxPFRbond02 | 0<br>> >> > > > defrag.ipv6.timeouts | RxPFRbond02 | 0<br>> >> > > > defrag.max_frag_hits | RxPFRbond02 | 0<br>> >> > > > tcp.sessions | RxPFRbond02 | 172432<br>> >> > > > tcp.ssn_memcap_drop | RxPFRbond02 | 0<br>> >> > > > tcp.pseudo | RxPFRbond02 | 79224<br>> >> > > > tcp.pseudo_failed | RxPFRbond02 | 0<br>> >> > > > tcp.invalid_checksum | RxPFRbond02 | 0<br>> >> > > > tcp.no_flow | RxPFRbond02 | 0<br>> >> > > > tcp.syn | RxPFRbond02 | 183912<br>> >> > > > tcp.synack | RxPFRbond02 | 150219<br>> >> > > > tcp.rst | RxPFRbond02 | 143693<br>> >> > > > tcp.segment_memcap_drop | RxPFRbond02 | 0<br>> >> > > > tcp.stream_depth_reached | RxPFRbond02 | 105<br>> >> > > > tcp.reassembly_gap | RxPFRbond02 | 4710<br>> >> > > > detect.alert | RxPFRbond02 | 3469<br>> >> > > > capture.kernel_packets | RxPFRbond03 | 38750498<br>> >> > > > capture.kernel_drops | RxPFRbond03 | 1511800<br>> >> > > > decoder.pkts | RxPFRbond03 | 38762341<br>> >> > > > decoder.bytes | RxPFRbond03 | 32714534213<br>> >> > > > decoder.invalid | RxPFRbond03 | 0<br>> >> > > > decoder.ipv4 | RxPFRbond03 | 39299710<br>> >> > > > decoder.ipv6 | RxPFRbond03 | 512<br>> >> > > > decoder.ethernet | RxPFRbond03 | 38762341<br>> >> > > > decoder.raw | RxPFRbond03 | 0<br>> >> > > > decoder.null | RxPFRbond03 | 0<br>> >> > > > decoder.sll | RxPFRbond03 | 0<br>> >> > > > decoder.tcp | RxPFRbond03 | 21943466<br>> >> > > > decoder.udp | RxPFRbond03 | 15992492<br>> >> > > > decoder.sctp | RxPFRbond03 | 0<br>> >> > > > decoder.icmpv4 | RxPFRbond03 | 178089<br>> >> > > > decoder.icmpv6 | RxPFRbond03 | 0<br>> >> > > > decoder.ppp | RxPFRbond03 | 0<br>> >> > > > decoder.pppoe | RxPFRbond03 | 0<br>> >> > > > decoder.gre | RxPFRbond03 | 0<br>> >> > > > decoder.vlan | RxPFRbond03 | 0<br>> >> > > > decoder.vlan_qinq | RxPFRbond03 | 0<br>> >> > > > decoder.teredo | RxPFRbond03 | 512<br>> >> > > > decoder.ipv4_in_ipv6 | RxPFRbond03 | 0<br>> >> > > > decoder.ipv6_in_ipv6 | RxPFRbond03 | 0<br>> >> > > > decoder.mpls | RxPFRbond03 | 0<br>> >> > > > decoder.avg_pkt_size | RxPFRbond03 | 843<br>> >> > > > decoder.max_pkt_size | RxPFRbond03 | 1514<br>> >> > > > decoder.erspan | RxPFRbond03 | 0<br>> >> > > > flow.memcap | RxPFRbond03 | 0<br>> >> > > > defrag.ipv4.fragments | RxPFRbond03 | 1078454<br>> >> > > > defrag.ipv4.reassembled | RxPFRbond03 | 537369<br>> >> > > > defrag.ipv4.timeouts | RxPFRbond03 | 0<br>> >> > > > defrag.ipv6.fragments | RxPFRbond03 | 0<br>> >> > > > defrag.ipv6.reassembled | RxPFRbond03 | 0<br>> >> > > > defrag.ipv6.timeouts | RxPFRbond03 | 0<br>> >> > > > defrag.max_frag_hits | RxPFRbond03 | 0<br>> >> > > > tcp.sessions | RxPFRbond03 | 169832<br>> >> > > > tcp.ssn_memcap_drop | RxPFRbond03 | 0<br>> >> > > > tcp.pseudo | RxPFRbond03 | 78504<br>> >> > > > tcp.pseudo_failed | RxPFRbond03 | 0<br>> >> > > > tcp.invalid_checksum | RxPFRbond03 | 0<br>> >> > > > tcp.no_flow | RxPFRbond03 | 0<br>> >> > > > tcp.syn | RxPFRbond03 | 181453<br>> >> > > > tcp.synack | RxPFRbond03 | 147649<br>> >> > > > tcp.rst | RxPFRbond03 | 139792<br>> >> > > > tcp.segment_memcap_drop | RxPFRbond03 | 0<br>> >> > > > tcp.stream_depth_reached | RxPFRbond03 | 94<br>> >> > > > tcp.reassembly_gap | RxPFRbond03 | 2567<br>> >> > > > detect.alert | RxPFRbond03 | 3416<br>> >> > > > capture.kernel_packets | RxPFRbond04 | 63727760<br>> >> > > > capture.kernel_drops | RxPFRbond04 | 3046651<br>> >> > > > decoder.pkts | RxPFRbond04 | 63747722<br>> >> > > > decoder.bytes | RxPFRbond04 | 55373084583<br>> >> > > > decoder.invalid | RxPFRbond04 | 0<br>> >> > > > decoder.ipv4 | RxPFRbond04 | 64056225<br>> >> > > > decoder.ipv6 | RxPFRbond04 | 487<br>> >> > > > decoder.ethernet | RxPFRbond04 | 63747722<br>> >> > > > decoder.raw | RxPFRbond04 | 0<br>> >> > > > decoder.null | RxPFRbond04 | 0<br>> >> > > > decoder.sll | RxPFRbond04 | 0<br>> >> > > > decoder.tcp | RxPFRbond04 | 55855784<br>> >> > > > decoder.udp | RxPFRbond04 | 7447497<br>> >> > > > decoder.sctp | RxPFRbond04 | 0<br>> >> > > > decoder.icmpv4 | RxPFRbond04 | 133539<br>> >> > > > decoder.icmpv6 | RxPFRbond04 | 0<br>> >> > > > decoder.ppp | RxPFRbond04 | 0<br>> >> > > > decoder.pppoe | RxPFRbond04 | 0<br>> >> > > > decoder.gre | RxPFRbond04 | 0<br>> >> > > > decoder.vlan | RxPFRbond04 | 0<br>> >> > > > decoder.vlan_qinq | RxPFRbond04 | 0<br>> >> > > > decoder.teredo | RxPFRbond04 | 487<br>> >> > > > decoder.ipv4_in_ipv6 | RxPFRbond04 | 0<br>> >> > > > decoder.ipv6_in_ipv6 | RxPFRbond04 | 0<br>> >> > > > decoder.mpls | RxPFRbond04 | 0<br>> >> > > > decoder.avg_pkt_size | RxPFRbond04 | 868<br>> >> > > > decoder.max_pkt_size | RxPFRbond04 | 1514<br>> >> > > > decoder.erspan | RxPFRbond04 | 0<br>> >> > > > flow.memcap | RxPFRbond04 | 0<br>> >> > > > defrag.ipv4.fragments | RxPFRbond04 | 619405<br>> >> > > > defrag.ipv4.reassembled | RxPFRbond04 | 308503<br>> >> > > > defrag.ipv4.timeouts | RxPFRbond04 | 0<br>> >> > > > defrag.ipv6.fragments | RxPFRbond04 | 0<br>> >> > > > defrag.ipv6.reassembled | RxPFRbond04 | 0<br>> >> > > > defrag.ipv6.timeouts | RxPFRbond04 | 0<br>> >> > > > defrag.max_frag_hits | RxPFRbond04 | 0<br>> >> > > > tcp.sessions | RxPFRbond04 | 171368<br>> >> > > > tcp.ssn_memcap_drop | RxPFRbond04 | 0<br>> >> > > > tcp.pseudo | RxPFRbond04 | 78609<br>> >> > > > tcp.pseudo_failed | RxPFRbond04 | 0<br>> >> > > > tcp.invalid_checksum | RxPFRbond04 | 0<br>> >> > > > tcp.no_flow | RxPFRbond04 | 0<br>> >> > > > tcp.syn | RxPFRbond04 | 182409<br>> >> > > > tcp.synack | RxPFRbond04 | 149124<br>> >> > > > tcp.rst | RxPFRbond04 | 143473<br>> >> > > > tcp.segment_memcap_drop | RxPFRbond04 | 0<br>> >> > > > tcp.stream_depth_reached | RxPFRbond04 | 82<br>> >> > > > tcp.reassembly_gap | RxPFRbond04 | 35459<br>> >> > > > detect.alert | RxPFRbond04 | 3770<br>> >> > > > flow_mgr.closed_pruned | FlowManagerThread | 310602<br>> >> > > > flow_mgr.new_pruned | FlowManagerThread | 549722<br>> >> > > > flow_mgr.est_pruned | FlowManagerThread | 380334<br>> >> > > > flow.spare | FlowManagerThread | 799999<br>> >> > > > flow.emerg_mode_entered | FlowManagerThread | 0<br>> >> > > > flow.emerg_mode_over | FlowManagerThread | 0<br>> >> > > > flow.tcp_reuse | FlowManagerThread | 237<br>> >> > > > flow_mgr.closed_pruned | FlowManagerThread | 308878<br>> >> > > > flow_mgr.new_pruned | FlowManagerThread | 544586<br>> >> > > > flow_mgr.est_pruned | FlowManagerThread | 379393<br>> >> > > > flow.spare | FlowManagerThread | 799402<br>> >> > > > flow.emerg_mode_entered | FlowManagerThread | 0<br>> >> > > > flow.emerg_mode_over | FlowManagerThread | 0<br>> >> > > > flow.tcp_reuse | FlowManagerThread | 252<br>> >> > > > tcp.memuse | Global | 439248976<br>> >> > > > tcp.reassembly_memuse | Global | 1717630000<br>> >> > > > dns.memuse | Global | 476478<br>> >> > > > dns.memcap_state | Global | 0<br>> >> > > > dns.memcap_global | Global | 0<br>> >> > > > http.memuse | Global | 536216<br>> >> > > > http.memcap | Global | 0<br>> >> > > > flow.memuse | Global | 237040288<br>> >> > > ><br>> >> > > ><br>> >> > > > _______________________________________________<br>> >> > > > Suricata IDS Users mailing list:<br>> >> > > > oisf-users@openinfosecfoundation.org<br>> >> > > > Site: http://suricata-ids.org | Support:<br>> >> > > > http://suricata-ids.org/support/<br>> >> > > > List:<br>> >> > > > https://lists.openinfosecfoundation.org/mailman/listinfo/oisf-users<br>> >> > > > Suricata User Conference November 9-11 in Washington, DC:<br>> >> > > > http://oisfevents.net<br>> >> > ><br>> >> > ><br>> >> > ><br>> >> > > --<br>> >> > > Regards,<br>> >> > > Peter Manev<br>> >><br>> >><br>> >><br>> >><br>> >> --<br>> >> Regards,<br>> >> Peter Manev<br>> <br>> <br>> <br>> -- <br>> Regards,<br>> Peter Manev<br></div></div> </div></body>
</html>