=== DATE === Sun Nov 8 22:27:22 CET 2026 === SYSTEM === FreeBSD OPNsense.internal 15.1-RELEASE-p6 FreeBSD 15.1-RELEASE-p6 stable/26.7-n284176-c962f76493b6 SMP amd64 15.1-RELEASE-p6 15.1-RELEASE-p6 15.1-RELEASE-p6 === SURICATA PACKAGE === suricata-8.0.8 Name : suricata Version : 8.0.8 Installed on : Sat Oct 31 01:23:52 2026 CET Origin : opnsense/suricata Architecture : FreeBSD:15:amd64 Prefix : /usr/local Categories : opnsense security Licenses : GPLv2 Maintainer : franco@opnsense.org WWW : https://suricata.io Comment : High Performance Network IDS, IPS and Security Monitoring engine Options : GEOIP : off HYPERSCAN : on IPFW : on LUA : off LUAJIT : off NETMAP : on NSS : on PORTS_PCAP : off PYTHON : on REDIS : off TESTS : off Shared Libs required: libc.so.7 libelf.so.2 libgcc_s.so.1 libhs.so.5 libjansson.so.4 liblz4.so.1 libm.so.5 libmagic.so.4 libnet.so.9 libnetmap.so.5 libpcap.so.8 libpcre2-8.so.0 librt.so.1 libthr.so.3 libyaml-0.so.2 libz.so.6 Annotations : FreeBSD_version: 1501000 cpe : cpe:2.3:a:openinfosecfoundation:suricata:8.0.8:::::freebsd15:x64 repo_type : binary repository : OPNsense Flat size : 15.0MiB Description : The Suricata Engine is an Open Source Next Generation Intrusion Detection and Prevention Engine developed by the Open Information Security Foundation (OISF). This engine is not intended to just replace or emulate the existing tools in the industry, but will bring new ideas and technologies to the field. OISF is part of and funded by the Department of Homeland Security's Directorate for Science and Technology HOST program (Homeland Open Security Technology), by the Navy's Space and Naval Warfare Systems Command (SPAWAR), as well as through the very generous support of the members of the OISF Consortium. More information about the Consortium is available, as well as a list of our current Consortium Members. === PROCESSES === 78429 1 Sat Nov 7 21:29:14 2026 Ss /usr/local/bin/suricata -D --netmap --pidfile /var/run/suricata.pid -c /usr/local/etc/suricata/suricata.yaml 33040 99947 Sun Nov 8 22:27:22 2026 S+ /bin/sh -c P=$(cat /var/run/suricata.pid 2>/dev/null); { echo "=== DATE ==="; date; echo "=== SYSTEM ==="; uname -a; freebsd-version -kru; echo "=== SURICATA PACKAGE ==="; pkg info suricata; echo "=== PROCESSES ==="; ps -axww -o pid,ppid,lstart,stat,command | grep -E "[s]uricata|[p]wait"; if [ -n "$P" ] && kill -0 "$P" 2>/dev/null; then echo "=== SURICATA KERNEL STACKS ==="; procstat -kk "$P"; echo "=== SURICATA OPEN FILES ==="; procstat -f "$P"; fi; echo "=== THREAD CPU ==="; top -H -T -b -n 3 -d 2 | grep -E "PID|suricata|W#01-pppoe0"; echo "=== NETMAP COUNTERS ==="; sysctl dev.netmap.iflib_rx_miss dev.netmap.iflib_rx_miss_bufs; echo "=== ZFS ARC ==="; sysctl kstat.zfs.misc.arcstats.size kstat.zfs.misc.arcstats.data_size kstat.zfs.misc.arcstats.metadata_size kstat.zfs.misc.arcstats.c_max; echo "=== ZFS LOG DATASET ==="; zfs get compression,compressratio,used,logicalused,available zroot/var/log; echo "=== FILESYSTEM ==="; df -h /var/log/suricata; echo "=== SURICATA LOG SIZES ==="; ls -lh /var/log/suricata/suricata_2026110[678].log; } > /root/oisf-suricata-report/05-runtime-diagnostics.txt 2>&1 === SURICATA KERNEL STACKS === PID TID COMM TDNAME KSTACK 78429 100431 suricata - mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_timedwait_sig+0x12 _sleep+0x180 kern_clock_nanosleep+0x24f sys_nanosleep+0x3b amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103092 suricata W#01-pppoe0 mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_wait_sig+0x9 _sleep+0x197 umtxq_sleep+0x2cd do_lock_umutex+0x670 __umtx_op_wait_umutex+0x49 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103099 suricata W#01-pppoe0^ mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_wait_sig+0x9 _sleep+0x197 umtxq_sleep+0x2cd do_lock_umutex+0x670 __umtx_op_wait_umutex+0x49 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103100 suricata FM#01 mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_timedwait_sig+0x12 _sleep+0x180 umtxq_sleep+0x2cd do_wait+0x258 __umtx_op_wait_uint_private+0x54 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103101 suricata FR#01 mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_timedwait_sig+0x12 _sleep+0x180 umtxq_sleep+0x2cd do_wait+0x258 __umtx_op_wait_uint_private+0x54 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103102 suricata CW mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_timedwait_sig+0x12 _sleep+0x180 umtxq_sleep+0x2cd do_wait+0x258 __umtx_op_wait_uint_private+0x54 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 78429 103103 suricata CS mi_switch+0xbc sleepq_catch_signals+0x27d sleepq_timedwait_sig+0x12 _sleep+0x180 umtxq_sleep+0x2cd do_wait+0x258 __umtx_op_wait_uint_private+0x54 sys__umtx_op+0x7e amd64_syscall+0x126 fast_syscall_common+0xf8 === SURICATA OPEN FILES === PID COMM FD T V FLAGS REF OFFSET PRO NAME 78429 suricata text v r r------- - - - /usr/local/bin/suricata 78429 suricata cwd v d r------- - - - / 78429 suricata root v d r------- - - - / 78429 suricata 0 v c rw------ 3 0 - /dev/null 78429 suricata 1 v c rw------ 3 0 - /dev/null 78429 suricata 2 v c rw------ 3 0 - /dev/null 78429 suricata 3 s - rw------ 1 0 UDD /var/run/log 78429 suricata 4 v r -wa----- 1 0 - /var/log/suricata/eve.json 78429 suricata 5 v r -wa----- 1 543236 - /var/log/suricata/stats.log 78429 suricata 6 v c rw------ 1 0 - /dev/netmap 78429 suricata 7 v c rw------ 1 0 - /dev/netmap 78429 suricata 8 v c rw------ 1 0 - /dev/netmap 78429 suricata 9 v c rw------ 1 0 - /dev/netmap === THREAD CPU === 103099 root 125 0 4112M 1875M CPU5 5 798:20 71.14% suricata{W#01-pppoe0^} 103092 root 59 0 4112M 1875M umtxn 3 800:54 70.95% suricata{W#01-pppoe0} 103092 root 125 0 4112M 1875M CPU6 6 800:56 72.31% suricata{W#01-pppoe0} 103099 root 59 0 4112M 1875M umtxn 2 798:22 70.91% suricata{W#01-pppoe0^} === NETMAP COUNTERS === dev.netmap.iflib_rx_miss: 46306 dev.netmap.iflib_rx_miss_bufs: 47703 === ZFS ARC === kstat.zfs.misc.arcstats.size: 8496067920 kstat.zfs.misc.arcstats.data_size: 7809711616 kstat.zfs.misc.arcstats.metadata_size: 344950784 kstat.zfs.misc.arcstats.c_max: 15776538624 === ZFS LOG DATASET === NAME PROPERTY VALUE SOURCE zroot/var/log compression lz4 inherited from zroot zroot/var/log compressratio 15.95x - zroot/var/log used 421G - zroot/var/log logicalused 6.53T - zroot/var/log available 469G - === FILESYSTEM === Filesystem Size Used Avail Capacity Mounted on zroot/var/log 890G 421G 469G 47% /var/log === SURICATA LOG SIZES === -rwx------ 1 root wheel 766G Nov 7 00:00 /var/log/suricata/suricata_20261106.log -rw------- 1 root wheel 687G Nov 7 21:31 /var/log/suricata/suricata_20261107.log -rw------- 1 root wheel 589G Nov 8 22:27 /var/log/suricata/suricata_20261108.log