If I assign suricata to monitor more than one interface, the suricata process consumes 100% CPU for about 30 seconds at startup, then crashes and repeats.

This appears to be because we use the same "cluster-id: 99" for every interface under the "af-packet" section of the YAML config. I am relatively new to configuring this daemon, but from a quick perusal of documentation and reference materials I could find, a unique cluster_id is expected for every interface (these can simply be incrementing or decrementing numbers—it's not clear what the acceptable range is or whether it is possible to conflict with other applications).