@puma2009 - which PF_RING version are you using? There was an issue around poll/epoll reported ~2.5years ago when upgrading to Zeek 6.0 that we reported to PF_RING. It was with PF_RING 8.2.0 and the fix made it into PF_RING 8.8.0 or later.
Alternatively, a fix in Zeek would be to try and put the following into local.zeek to poll PF_RING more often:
# local.zeek - Use more aggressive polling to avoid polling issue with kqueue and PF_RING < 8.8.0.
redef io_poll_interval_live = 100;
So if you don’t yet have PF_RING 8.8.0 or later, try upgrading or see if the above redef helps.
Please report back if any of these steps helps.