Suricata

Suricata can fail to start up with this error:

Error: threads: thread "W#01-ens6f0" failed to start in time: flags 0003 [TmThreadWaitOnThreadRunning:tm-threads.c:1840]

This happens when there are many threads (>100) and they have a large ring-size in af-packet and the network is very loaded. The start up and AFPSynchronizeStart appear to take too much time, and the TmThreadWaitOnThreadRunning function fails with the error above. This timer allows for 60s for the threads to start up and synchronize.

Almost all time is spent in the kernel, it seems:

  96.16%  [kernel.kallsyms]                                                                                                                                                                                                                                                               
   2.37%  libc.so.6                                                                                                                                                                                                                                                                       
   1.37%  suricata                                                                                                                                                                                                                                                                        
   0.05%  libhs.so.5.4.0                                                                                                                                                                                                                                                                  
   0.03%  [vdso]                                                                                                                                                                                                                                                                          
   0.01%  ld-linux-x86-64.so.2                                                                                                                                                                                                                                                            
   0.00%  libpcre2-8.so.0.10.4                                                                                                                                                                                                                                                            
   0.00%  libjansson.so.4.13.0                                                                                                                                                                                                                                                            
   0.00%  libstdc++.so.6.0.30                                                                                                                                                                                                                                                             
   0.00%  libyaml-0.so.2.0.6