Sensor Health

Suricata engine performance counters from the periodic `stats` EVE event. Counters are cumulative since the engine started; the KPIs below reflect the most recent snapshot in the window. Rising Reassembly Gaps or Memcap Drops mean the sensor is losing packets or hitting resource limits — the key sensor-health signals. (Kernel packet/drop counters aren't shown here: hardware captures like fmadio-ring don't expose the AF_PACKET capture.kernel_* stats.)

Sensor Trends

Hourly trend of the sensor's cumulative Suricata counters over the window. The two health signals come first: a flat Reassembly Gaps or Memcap Drops line means the sensor is keeping up, a rising line means it is losing packets or hitting resource limits. A dip back toward zero marks an engine restart. Each chart auto-scales independently.