Switch up your relays, try different clients. Primal doesn't show all posts that cross your relays (and i don't know why). Though be warned: When you go to global in Snort, get ready for your PC to wake the hell up. It's like mining; executing JSON.parse as fast and many times as possible - there's a lot happening. But on the flipside? Its real-time.