Snort ignores memcap settings
Snort is giving off many of these notifications in the system log:
snort: S5: Pruned 1 sessions from cache for memcap. 1 ssns remain. memcap: 104/8388608
Raising Max Queued Bytes or Max Queued Segs does not resolve this.
Was discussed in this thread but seems to have fallen off from notice.