Enabling mmap-locked.

[BigMacCat]

Hi everyone!
We are seeing quite high packet loss on Suricata with a relatively powerful installation (256 gb ram, 112 cpu, 20 tb SSD).
Suricata is losing 10-40% at 6-20 gbit load
We have tried all sorts of settings, we even changed our network cards to Intel X722, but nothing has changed.
Now we want to enable mmap-locked to see if it makes a difference. But every time we enable this option on the sensor, the so-suricata container crashes.
I guess we need to add the --cap-add IPC_LOCK flag to the container, we tried adding the option to
/root/SecurityOnion/salt/suricata/enabled.sls, but it didn't help..
Can anyone tell how to enable this option correctly?

[cm-ops]

#12835 (reply in thread) Are you on at least 2.4.70? Also, take note of the warning.

Should be able to set mmap-locked in SOC > Administration > Configuration > suricata > config > af-packet > mmap-locked change to yes.

[BigMacCat]

Hi!

#12835 (reply in thread) Are you on at least 2.4.70? Also, take note of the warning.

We are on 2.4.110.

Should be able to set mmap-locked in SOC > Administration > Configuration > suricata > config > af-packet > mmap-locked change to yes.

Yes, I changed this value to yes, and yes, everything was exactly as described in the warning. After using this option, the so-suricata container on the sensor crashes. That's why I asked the question: how to grant additional permissions to the Docker container?

[cm-ops]

Setting it in the enabled.sls you would want to follow this: https://docs.saltproject.io/en/3006/ref/states/all/salt.states.docker_container.html

ipc_mode (or ipc)
Set the IPC mode for the container. The default behavior is to create a private IPC namespace for the container, but this option can be used to change that behavior:

container:<container_name_or_id> reuses another container shared memory, semaphores and message queues

host: use the host's shared memory, semaphores and message queues