How to install on Ubuntu 22.04 LTS?

[ralyodio]

I just upgraded my ubuntu server to 22.04. The script says this OS is not supported, is there any effort to get it working on latest version of Ubuntu?

[TOoSmOotH]

I am assuming you are referring to 2.3 and the answer is no 22.04 is not supported. There are no plans to support 22.04 with 2.3 or 2.4 as we are transitioning to Rocky Linux 9. 20.04 is the only supported version in 2.4 and is only supported on non manager type nodes so that folks with larger deployments will have time to migrate as hardware refreshes.

[TheZackCodec]

@TOoSmOotH Has this changed? When I install 2.4 Main on Ubuntu 22.04.3 I've been having some elastic fleet issues directly after install. The official documentation mentions that it is at least compatible with 22.04. I know in the documentation it is listed as unsupported in a "We do not test it that much but it mostly works" way, but are you saying here it is known not to work?

• In this Blog Post
• documentation

[TOoSmOotH]

This is an old post. Redhat changing their direction on clones forced us to make changes. At that time there were no plans to make it work with Ubuntu 22.04 but as we tested alternatives to Rocky we put in the code to allow for alternative OS installs. Going with the official ISO is the most supported model. We do limited testing on anything that is not Oracle Linux 9. As far as I am aware there are no issues with Ubuntu 22.04 at this time but it is not tested like OEL9 is. My recommendation is to install using Oracle.

[TheZackCodec]

@TOoSmOotH Thanks for the quick reply. I was slightly confused because when installing 2.3 on Ubuntu 20.04.6 the installer did not complain about the OS being "Unsupported" but now when installing 2.4 on 22.04.3 it reports before install "This OS is unsupported do you still wish to install". So I thought my errors might have just been because 22.04 was not actually compatible.

I know this isn't the place to report a problem so I may open an issue ticket if I can give better details later but after a standalone install or a mansearch and forward install on Ubuntu 22.04.3 the monitor interfaces report traffic but no logs are imported.

I noticed that in the Ubuntu install's fleet view, the Fleet server is not visible and the installer complained about an error. However, in the direct Security onion install I tried, the installer complained in the same way but the logs were importing and the fleet server was visible in the fleet view. So there is something weird going on with the fleet server on the Ubuntu Installs on the Main branch.

Also I understand that Oracle Linux is the preferred OS but if I have RHEL licenses' is officially supported? Just not recommended because it is not free?

[TOoSmOotH]

Sorry I guess I am confused. 2.3 supports 20.04, 18.04, and CentOS 7. There are no plans to change any of that in 2.3 as it will be end of life eventually. 2.4 officially supports Oracle Linux 9. It will run on the operating systems that are defined in the blog post. RHEL should work for 2.4 but it isn't our main supported OS so its not officially supported.

[TheZackCodec]

@TOoSmOotH Again thank you for the quick response. The confusion was my fault I think I failed to explained it correctly.

I was trying to say that SO 2.3 does NOT complain about Ubuntu 20.04 during the so-network-install script even though it is not officially supported.

However, during the SO 2.4 install on Ubuntu 22.04 it was saying that it was unsupported. This led me to believe that maybe 22.04 was actually incompatible instead of just unsupported because I was immediately experiencing issues on install on a clean Ubuntu 22.04 install.

And I thought that 22.04 was the specific cause of the elastic fleet issues I was experiencing with 2.4 on 22.04. The fleet issues MAY be fixed in the DEV branch of 2.4 but I have to do more testing to determine that.