Suricata not Working after Cpu change
-
hi guys
been running fine without any problems , iv manage to get a good deal on a X3460 xeon for my old Dell server , since i had a x3430 with 4 cores , the x3460 has 8 , iv changed it ... but after i did , suricate does not run any more , i even tried to installed the server again , and added the backup settings , still the same .....
for my surprise after i put the old 4 core cpu .. suricata runs without any problem , seem that my suricate maybe configured for the old one , but im not seeing where to change that ... has anyone been true this , how can i solve this so i can change to the 8 core cpu
please can anyone help me ??
thanks
-
Very simple fix. More CPU cores requires having much more TCP Stream Flow memory allocated. The default limit for this parameter is sufficient for 4-core and lower CPUs, but high core-count boxes need to have it increased.
Here is a link to an earlier thread about the issue: https://forum.netgate.com/topic/139580/suricata-failing-to-start-interface. Start increasing the value upward from the 32 MB default. If you have plenty of RAM, then set it to 256 MB or even 512 MB and see how that works. There is a formula someone once shared here on the forum for calculating the required memory for a given core count.
-
@bmeeks thank you very much after setting the memory from 32 m to almost 1000 m it started ..... , but will try with lower
thank you very much
-
@cavaco said in Suricata not Working after Cpu change:
@bmeeks thank you very much after setting the memory from 32 m to almost 1000 m it started ..... , but will try with lower
thank you very much
Yeah, 1024 MB is probably a bit much unless you have tons of free RAM. Try 512 MB or even 256 MB instead.
