Some containers in WAIT_START status

[ivanrdrgz]

Hi everyone! It's my first time working with Security Onion so I'm having some troubles with it. I am student and I'm doing my end-of-degree thesis about create a small test network and use Security Onion as cybersecurity system to monitoring it. Now I'm stalling Security Onion in VirtualBox to make some test and have a first touch before installing it in the network I have designed.

The configuration is supposed to be finished, but when I run sudo so-status, all containers are OK except the following, which are in WAIT_START status:
so-curator
so-elastalert
so-filebeat
so-fleet
so-playbook
so-steno
so-suricata

My configuration of Security onion 2.3.230 is:

• 4gb of RAM, 2 cores, and 200gb of storage.
• 2 network adapters, first for management as NAT Network and second for sniffing as Host-only
• Standalone mode, because is the one I want to use in the future network
• Standard configuration instead of Airgap.
• No proxy
• Suricata as metadata tool
• ETOpen as IDS rules
• All aditional services
• IP format to access to web interface
• Number of suricata process: 1
• No NTP server
• NodeBasic
• so-allow enabled

I also cannot connect to Security Onion by web interface

Thank you all in advance!

[dougburks]

If you only have 4GB RAM, then you will only be able to use IMPORT mode:
https://docs.securityonion.net/en/2.3/hardware.html

If you want to use STANDALONE mode, then you will you need at least 16GB RAM:
https://docs.securityonion.net/en/2.3/hardware.html#standalone-deployments

[ivanrdrgz]

Thank you for your answer!

I know it, but as a test environment I thought it would be enough to do the installation and launch it via the web. So, can you confirm that the reason for the failure is the hardware and not a software configuration failure?

Thank you in advance again

[dougburks]

If you don't follow the minimum requirements, then you should expect things to not work properly.