Suricata

Running 6.0.2 and am running into this issue on a few systems. They are seemingly identical, but for some reason the BPF errors on one, but not another.

1/2/2022 -- 17:29:14 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=103 frame_size=1600 frame_nr=2060
1/2/2022 -- 17:29:14 - <Info> - Using BPF '                                                                                                                                                      not ( host 141.2
06.161.42 and port 514 ) and not ( host 141.206.161.42 and port 1514 ) and not ( host 141.206.161.42 and port 2514 ) and not ( host 141.206.161.42 and port 3514 ) and not ( host 141.206.161.42 and port 4514 )
and not ( host 141.206.161.42 and port 5514 ) and not ( host 141.206.161.42 and port 6514 ) and not ( host 141.206.161.42 and port 7514 ) and not ( host 141.206.161.42 and port 8514 ) and not ( host 141.206.16
1.42 and port 9514 ) and not ( host 2.2.2.1 and port 514 ) and not ( host 2.2.2.1 and port 1514 ) and not ( host 2.2.2.1 and port 2514 ) and not ( host 2.2.2.1 and port 3514 ) and not ( host 2.2.2.1 and port 4
514 ) and not ( host 2.2.2.1 and port 5514 ) and not ( host 2.2.2.1 and port 6514 ) and not ( host 2.2.2.1 and port 7514 ) and not ( host 2.2.2.1 and port 8514 ) and not ( host 2.2.2.1 and port 9514 ) and not
( host 10.128.134.100 and port 514 ) and not ( host 10.128.134.100 and port 1514 ) and not ( host 10.128.134.100 and port 2514 ) and not ( host 10.128.134.100 and port 3514 ) and not ( host 10.128.134.100 and
port 4514 ) and not ( host 10.128.134.100 and port 5514 ) and not ( host 10.128.134.100 and port 6514 ) and not ( host 10.128.134.100 and port 7514 ) and not ( host 10.128.134.100 and port 8514 ) and not ( hos
t 10.128.134.100 and port 9514 ) and                                   not port 3260' on iface 'e1'
1/2/2022 -- 17:29:14 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Failed to attach filter: Cannot allocate memory
1/2/2022 -- 17:29:14 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't init AF_PACKET socket, fatal error

And on a working system...

28/1/2022 -- 19:41:43 - <Perf> - AF_PACKET RX Ring params: block_size=32768 block_nr=103 frame_size=1600 frame_nr=2060
28/1/2022 -- 19:41:43 - <Info> - Using BPF '                                                                                                                                                      not ( host 141.206.161.42 and port 514 ) and not ( host 141.206.161.42 and port 1514 ) and not ( host 141.206.161.42 and port 2514 ) and not ( host 141.206.161.42 and port 3514 ) and not ( host 141.206.161.42 and port 4514 ) and not ( host 141.206.161.42 and port 5514 ) and not ( host 141.206.161.42 and port 6514 ) and not ( host 141.206.161.42 and port 7514 ) and not ( host 141.206.161.42 and port 8514 ) and not ( host 141.206.161.42 and port 9514 ) and not ( host 2.2.2.1 and port 514 ) and not ( host 2.2.2.1 and port 1514 ) and not ( host 2.2.2.1 and port 2514 ) and not ( host 2.2.2.1 and port 3514 ) and not ( host 2.2.2.1 and port 4514 ) and not ( host 2.2.2.1 and port 5514 ) and not ( host 2.2.2.1 and port 6514 ) and not ( host 2.2.2.1 and port 7514 ) and not ( host 2.2.2.1 and port 8514 ) and not ( host 2.2.2.1 and port 9514 ) and not ( host 10.128.134.100 and port 514 ) and not ( host 10.128.134.100 and port 1514 ) and not ( host 10.128.134.100 and port 2514 ) and not ( host 10.128.134.100 and port 3514 ) and not ( host 10.128.134.100 and port 4514 ) and not ( host 10.128.134.100 and port 5514 ) and not ( host 10.128.134.100 and port 6514 ) and not ( host 10.128.134.100 and port 7514 ) and not ( host 10.128.134.100 and port 8514 ) and not ( host 10.128.134.100 and port 9514 ) and                                   not port 3260' on iface 'e1'

For the ruleset...

not ( host 141.206.161.42 and port 514 ) and
not ( host 141.206.161.42 and port 1514 ) and
not ( host 141.206.161.42 and port 2514 ) and
not ( host 141.206.161.42 and port 3514 ) and
not ( host 141.206.161.42 and port 4514 ) and
not ( host 141.206.161.42 and port 5514 ) and
not ( host 141.206.161.42 and port 6514 ) and
not ( host 141.206.161.42 and port 7514 ) and
not ( host 141.206.161.42 and port 8514 ) and
not ( host 141.206.161.42 and port 9514 ) and
not ( host 2.2.2.1 and port 514 ) and
not ( host 2.2.2.1 and port 1514 ) and
not ( host 2.2.2.1 and port 2514 ) and
not ( host 2.2.2.1 and port 3514 ) and
not ( host 2.2.2.1 and port 4514 ) and
not ( host 2.2.2.1 and port 5514 ) and
not ( host 2.2.2.1 and port 6514 ) and
not ( host 2.2.2.1 and port 7514 ) and
not ( host 2.2.2.1 and port 8514 ) and
not ( host 2.2.2.1 and port 9514 ) and
not ( host 10.128.134.100 and port 514 ) and
not ( host 10.128.134.100 and port 1514 ) and
not ( host 10.128.134.100 and port 2514 ) and
not ( host 10.128.134.100 and port 3514 ) and
not ( host 10.128.134.100 and port 4514 ) and
not ( host 10.128.134.100 and port 5514 ) and
not ( host 10.128.134.100 and port 6514 ) and
not ( host 10.128.134.100 and port 7514 ) and
not ( host 10.128.134.100 and port 8514 ) and
not ( host 10.128.134.100 and port 9514 ) and
not port 3260