Wait_Start for all containers

[lmb2100]

I have a distributed deployment and I did a so-nsm-clear and so-elastic-clear on a forward node and now it says all of the containers on the sensor is wait_start. When I try to start the containers indiviually it says "Rendering SLS 'minions.securityonion2_sensor' failed. Please see master log for details." It was working before that command so I am not sure what happened because I did it on another sensor and it is working fine. I dont even know where the master log is. Thank you!!

[lmb2100]

Please see attached for Screenshots. Also is there a way to delete logs from the SOC? After I did those commands the logs still showed 50 Million+ on the SOC. I just wanted to get rid of the logs that were generated from testing.

[lmb2100]

[cm-ops]

You would need to run salt-call from the minion, the salt master service is only running on your manager node.

The master log is at /opt/so/log/salt/master on your manager node.

What does your minion pillar file look like at /opt/so/saltstack/local/pillar/minions/securityonion2_sensor.sls?

[lmb2100]

What else in the command salt-call? I am pretty new to salt and SO so please bear with me. Please see attached for the pillar file for the minion. Thanks!

[lmb2100]

So am I running a masterless minion? The salt master service is running on the manager but neither can find the master. The manager can still see one of the nodes on the grid and running salt-run manage.up shows the sensors. Thanks again!

[cm-ops]

You have to fix your firewall pillar:

firewall:
  assigned_hostgroups:
    chain:
      DOCKER-USER:
        hostgroups:
          wazuh_agent:
            portgroups:
              - portgroups.wazuh_agent
          syslog:
            portgroups:
              - portgroups.syslog

Pay attention to the spacing in the yaml file.