Suricata

Testing out latest stable (5.0.3) and git - specific corner case exposes a bottle neck with file magic logging.

In a specific high speed pcap replay that is entirely and only http/dns traffic with big number of unique sessions - enabling file magic logging triggers the issue - big drop percentage when the system is actually not busy at all.
What is observed during the runs :

• no memcaps hits
• CPUS are at 15-20%
• no rules loaded (on purpose) , just http and fileino logging enabled
• perf top shows no bottle neck or pegged CPUs in certain functions
• htop shows no CPUs pegged
• top shows no specific threads being pegged or being a bottle neck

Drops hit 50% as soon as the AFP v3 buffers get filled
The configs and pcaps will be shared privately privately