If I start with suricata -c suricata.yaml --nflog it fails to start up with:
<pre>
[31345] 7/4/2014 -- 11:50:31 - (source-nflog.c:265) <Error> (ReceiveNFLOGThreadInit) -- [ERRCODE: SC_ERR_NFLOG_MAX_BUFSIZ(248)] - Maximum buffer size (10) in NFLOG has been reached
</pre>
It seems that we need to set max-size to be higher than buffer-size to make this error go away.