The MMAP_DEFAULT is set to 10,000 on the sensor. When we receive an alert in the console for flexbit exhaustion, I went to the sensor and used saganpeek to see the active vs inactive counts. The active flexbits are only at 852 but the combined active and inactive are above the 10k threshold, 17227.
$ sudo saganpeek | grep "Signature:" | wc -l
852
$ sudo saganpeek -a | grep "Signature:" | wc -l
17227
The
MMAP_DEFAULTis set to 10,000 on the sensor. When we receive an alert in the console for flexbit exhaustion, I went to the sensor and usedsaganpeekto see the active vs inactive counts. The active flexbits are only at 852 but the combined active and inactive are above the 10k threshold, 17227.