Messages

... and a wiser way to describe compatibility would be to enumerate required CPU flags, instead of listing all variants of CPU released on the market.

Mokaz's solution worked.

As a preface, I must say I could never activate IPS with hyperscan matcher on this VM.
That VM presented some other limitations compared to its twin, almost identical, except for the CPU type.

After reading Mokaz's solution I did not go for same CPU as him but simply abandoned the KVM64, for the «Broadwell, IBRS», the one used on the almost twin VM and it solved the problem.
(and I'll keep an eye on any difference that may appear or persist between the twin VMs)

Thank You!!!

Clearly, KVM64 CPU emulation misses flags required by hyperscan to perform.

An embryo of CPU compatibility list includes:

• Broadwell, IBRS
• Haswell-noTSX

Had the same issue, here is what fixed it for me:

• updated the vCPU scheme of the VM from "kvm64" to "Haswell-noTSX".
• VM power off/power on.
• shifted the IPS engine from "Aho–Corasick Ken Steele variant" to "Hyperscan" (only possible post point #1 here).

According to the docs, Hpyerscan seems to be the best options whenever supported, I'll leave it at that here.
https://docs.opnsense.org/manual/ips.html