diff --git a/sys/netinet/siftr.c b/sys/netinet/siftr.c
--- a/sys/netinet/siftr.c
+++ b/sys/netinet/siftr.c
@@ -372,12 +372,15 @@
 	}
 }
 
-static void
-siftr_process_pkt(struct pkt_node * pkt_node)
+static int
+siftr_process_pkt(struct pkt_node * pkt_node, char *buf)
 {
 	struct flow_hash_node *hash_node;
 	struct listhead *counter_list;
-	struct ale *log_buf;
+	int ret_sz;
+
+	if (buf == NULL)
+		return 0; /* Should only happen if the ALQ is shutting down. */
 
 	if (pkt_node->flowid == 0) {
 		panic("%s: flowid not available", __func__);
@@ -387,7 +390,7 @@
 	hash_node = siftr_find_flow(counter_list, pkt_node->flowid);
 
 	if (hash_node == NULL) {
-		return;
+		return 0;
 	} else if (siftr_pkts_per_log > 1) {
 		/*
 		 * Taking the remainder of the counter divided
@@ -403,16 +406,11 @@
 		 * we wrote a log message for this connection, return.
 		 */
 		if (hash_node->counter > 0)
-			return;
+			return 0;
 	}
 
-	log_buf = alq_getn(siftr_alq, MAX_LOG_MSG_LEN, ALQ_WAITOK);
-
-	if (log_buf == NULL)
-		return; /* Should only happen if the ALQ is shutting down. */
-
 	/* Construct a log message. */
-	log_buf->ae_bytesused = snprintf(log_buf->ae_data, MAX_LOG_MSG_LEN,
+	ret_sz = snprintf(buf, MAX_LOG_MSG_LEN,
 	    "%c,%jd.%06ld,%s,%hu,%s,%hu,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,%u,"
 	    "%u,%u,%u,%u,%u,%u,%u,%u\n",
 	    direction[pkt_node->direction],
@@ -444,7 +442,7 @@
 	    pkt_node->flowid,
 	    pkt_node->flowtype);
 
-	alq_post_flags(siftr_alq, log_buf, 0);
+	return ret_sz;
 }
 
 static void
@@ -454,6 +452,9 @@
 	    STAILQ_HEAD_INITIALIZER(tmp_pkt_queue);
 	struct pkt_node *pkt_node, *pkt_node_temp;
 	uint8_t draining;
+	struct ale *log_buf;
+	int ret_sz, cnt;
+	char *bufp;
 
 	draining = 2;
 
@@ -489,12 +490,36 @@
 		 */
 		mtx_unlock(&siftr_pkt_mgr_mtx);
 
-		/* Flush all pkt_nodes to the log file. */
-		STAILQ_FOREACH_SAFE(pkt_node, &tmp_pkt_queue, nodes,
-		    pkt_node_temp) {
-			siftr_process_pkt(pkt_node);
-			STAILQ_REMOVE_HEAD(&tmp_pkt_queue, nodes);
-			free(pkt_node, M_SIFTR_PKTNODE);
+try_again:
+		pkt_node = STAILQ_FIRST(&tmp_pkt_queue);
+		if (pkt_node != NULL) {
+			if (STAILQ_NEXT(pkt_node, nodes) != NULL) {
+				cnt = 3;
+			} else {
+				cnt = 1;
+			}
+
+			log_buf = alq_getn(siftr_alq, MAX_LOG_MSG_LEN * cnt,
+					   ALQ_WAITOK);
+
+			log_buf->ae_bytesused = 0;
+			bufp = log_buf->ae_data;
+
+			/* Flush all pkt_nodes to the log file. */
+			STAILQ_FOREACH_SAFE(pkt_node, &tmp_pkt_queue, nodes,
+			    pkt_node_temp) {
+				ret_sz = siftr_process_pkt(pkt_node, bufp);
+				bufp += ret_sz;
+				log_buf->ae_bytesused += ret_sz;
+				STAILQ_REMOVE_HEAD(&tmp_pkt_queue, nodes);
+				free(pkt_node, M_SIFTR_PKTNODE);
+				cnt--;
+				if (cnt <= 0 && !STAILQ_EMPTY(&tmp_pkt_queue)) {
+					alq_post_flags(siftr_alq, log_buf, 0);
+					goto try_again;
+				}
+			}
+			alq_post_flags(siftr_alq, log_buf, 0);
 		}
 
 		KASSERT(STAILQ_EMPTY(&tmp_pkt_queue),