27/3/2017 -- 15:27:04 - <Notice> - This is Suricata version 3.2.1 RELEASE
27/3/2017 -- 15:27:04 - <Info> - CPUs/cores online: 32
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth2'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Found an MTU of 9216 for 'eth6'
27/3/2017 -- 15:27:04 - <Info> - Use pid file /data/suricata/var/run/suricata.pid from config file.
27/3/2017 -- 15:27:04 - <Info> - Running in live mode, activating unix socket
27/3/2017 -- 15:27:10 - <Info> - 38 rule files processed. 13509 rules successfully loaded, 0 rules failed
27/3/2017 -- 15:27:10 - <Info> - 13517 signatures processed. 1285 are IP-only rules, 5613 are inspecting packet payload, 8362 inspect application layer, 0 are decoder event only
27/3/2017 -- 15:27:19 - <Info> - Threshold config parsed: 0 rule(s) found
27/3/2017 -- 15:27:19 - <Info> - fast output device (regular) initialized: fast.log
27/3/2017 -- 15:27:19 - <Info> - eve-log output device (regular) initialized: eve.json
27/3/2017 -- 15:27:19 - <Info> - stats output device (regular) initialized: stats.log
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Going to use 1 thread(s)
27/3/2017 -- 15:27:19 - <Info> - Running in live mode, activating unix socket
27/3/2017 -- 15:27:19 - <Info> - Using unix socket file '/data/suricata/var/run/suricata/suricata-command.socket'
27/3/2017 -- 15:27:19 - <Notice> - all 12 packet processing threads, 4 management threads initialized, engine started.
27/3/2017 -- 15:27:30 - <Info> - All AFP capture threads are running.


  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth2
    threads: 1
    cluster-id: 99
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  - interface: eth6
    threads: 1
    cluster-id: 98
    cluster-type: cluster_flow
    defrag: yes
    use-mmap: yes
    tpacket-v3: yes
    ring-size: 400000
    block-size: 393216

  cpu-affinity:
    - management-cpu-set:
        cpu: [ 0,1 ]  # include only these cpus in affinity settings
    - worker-cpu-set:
        cpu: [ "4-15" ]
        mode: "exclusive"