Suricata is able to eat up whole /tmp space
The suricata logs to /var/log/surricata/suricata.log
and that log is not rotated thus it eventually eats up all space in /tmp
.
In my case it is due to error such as:
7/3/2022 -- 13:54:53 - <Error> - [ERRCODE: SC_ERR_AFP_CREATE(190)] - Couldn't set fanout mode, error Invalid argument