Since v2.0 upgrade, packet engine won't stay running

[Cljackhammer]

The dev.netmap.ring_num = 1024 recommendation also did not work for me. Setting the value to 2048 addressed my issue. I'm no longer seeing this error: Critical   eastpect stack overflow detected; terminated.

[simtra]

Never mind.  I found out what I was "working".  Zenarmor crashed and nothing was being filtered and until I looked at the dashboard, I did not notice.  I'm sorry about the invalid data.  I am personally working with emulated netdata driver and 1024 did not make a difference.

[Cljackhammer]

Same here 2048 is to large. This problem has not been resolved ZA team.

[sy]

Hi,

The value range is between 2 and 1024. Therefore, 2048 is not applicable. Additionally, 1024 is not functioning for some users, and we are currently investigating the issue.

[RutgerDiehard]

Same issue again this morning; packet engine stopped and unable to be restarted.

Code Select Expand

2025-06-14T03:42:57    Critical    eastpect    stack overflow detected; terminated
These are the settings that Support worked on remotely yesterday:

Code Select Expand

    dev.netmap.buf_num     runtime    1000000         
    dev.netmap.admode      runtime    0        
    dev.netmap.ring_num    runtime    1024    
    dev.netmap.buf_size    runtime    2048


How can I downgrade to the previous stable version while this is worked on and resolved? I cannot have these crashes in the middle of the night.

       

[RutgerDiehard]

Further to this, I run Suricata on the WAN interface which has been perfectly fine and have not had any issues for months. Recently, Suricata has been very quiet and there have been no detections for several weeks. So, questioning its value, I've just disabled Suricata IDS/IPS. I am now able to start the Zenarmor packet engine and it stays running.

One to note for troubleshooting purposes and maybe a workaround while this is resolved.

[Cljackhammer]

For those that it's failing are you configured for RSS? I see a warning in the console regarding RSS, but it worked in the past.

[Lurick]

For those that it's failing are you configured for RSS? I see a warning in the console regarding RSS, but it worked in the past.

I do have RSS enabled as well and in the past (a month ago) enabled it and haven't had issues until now.

[Cljackhammer]

RSS isn't the issue. The problem remains if it's disabled. Something changed with eastpect.

[Taunt9930]

Are you all using Suricata?

FWIW as another data point, have been updated for a few hours now and no issues. Not using Suricata.

[Seimus]

I have same problem,

ring_num increased to 1024, ZA still crashing after 7 hours of stability.



Regards,
S.