turns out it was Snort I used, as recovery worked perfectly, snatched nsec now.

Thanks for the help/suggestions.