[Oisf-users] suricata high CPU load

[Vieri]

Hi,

At times I get very high CPU load when running Suricata in IPS inline mode.

I configured iptables to load-balance NFQUEUE 0:1. I would like to know what the pros and cons are performance-wise if:

1) I run 2 suricata processes on each queue (ie. suricata -q 0 AND suricata -q 1)

2) I run only one suricata process on multiple queues (ie. suricata -q 0 -q 1)

Thanks,

Vieri