On 8/10/2014, at 4:07 pm, Russell Fulton <r.fulton at auckland.ac.nz> wrote: > > Also is there another way to stop suricata hogging all the CPU to the point where the kernel drops packets — apart from adding more cores ;) Discovered the answer with in seconds of hitting send. detect-thread-ratio: Doh! R