Suricata

Per-thread delta stats appear to be broken. I believe this is a known issue as I noticed some open pull requests, but wanted to open an issue in case it wasn't being tracked.

Here's some sample output from a single thread for reference. The delta value is the same as the counter value.

# tail -5 suricata-stats.log | jq .stats.threads.AFPacketbond01.capture
{
  "kernel_packets": 388738,
  "kernel_packets_delta": 388738,
  "kernel_drops": 0,
  "kernel_drops_delta": 0
}
{
  "kernel_packets": 414996,
  "kernel_packets_delta": 414996,
  "kernel_drops": 0,
  "kernel_drops_delta": 0
}
{
  "kernel_packets": 452493,
  "kernel_packets_delta": 452493,
  "kernel_drops": 0,
  "kernel_drops_delta": 0
}
{
  "kernel_packets": 485332,
  "kernel_packets_delta": 485332,
  "kernel_drops": 0,
  "kernel_drops_delta": 0
}
{
  "kernel_packets": 536934,
  "kernel_packets_delta": 536934,
  "kernel_drops": 0,
  "kernel_drops_delta": 0
}