Hi,
for the records:
Today I tested 'suricata 6.0.2' and '5.0.6' on Core 153/x86_64.
'suricata' was activated only on RED with a few rules from "EmergingThreats.net".
Hardware: https://fireinfo.ipfire.org/profile/5f68a6360ffbecb6877dcac75f5b8c8030f43ce8
*Nothing* has changed here, CPU load still rises from ~0.7% in idle mode to ~7-9% as soon as 'suricata' is started.
No further mails or reactions in the suricata forum on Michaels last comment (https://redmine.openinfosecfoundation.org/issues/4096#note-29).
Should I send an update to '5.0.6' or '6.0.2'? ;-)
Best, Matthias