In an effort to reduce capture loss, the af_packet buffer size was increased from the default to 2GB in node.cfg using “af_packet_buffer_size=210241024*1024”. The capture loss afterwards was zero but many of the other logs also went missing, including conn.log.
Going to 1GB with “af_packet_buffer_size=110241024*1024” and the missing logs started being collected again. The capture loss, while better, was still up to 10%.
Choosing the middle with 1.5GB via “af_packet_buffer_size=153610241024” (seems it has to be integer calculations) and several of the logs including conn.log went missing again.
The sensors all have 128 GB RAM for only 15 workers so memory should not be an issue. But it seems something goes wrong while trying to utilize the wealth of RAM.
Any idea what I am doing wrong?