some SO containers went missing

[SaharBerro]

Hello,

I wanted to install Security Onion 2.3 to monitor our VPN on OVH cloud.
I wanted to start with the import architecture. Then, I installed the Standalone architecture using UBUNTU 20.04 image. Few days later, some containers crashed and went missing and I was not able to re-start them. I thought that this was related to NIDS configuration, so I deleted the VM;I created another one and re-installed SO; Few days later I had the same problem: 2 SO containers went missing, this time it is Stenographer and Suricata. To understand what could be causing that I wanted to know more about:

1- Is SO compatible with OVH cloud? In the documentation I found a tutorial for AWS and Azure cloud but not for the OVH cloud. Specially that I need to apply modification to the /etc/netplan/00-installer-config.yaml that does not exist on OVH VM.
https://docs.securityonion.net/en/2.3/installation.html

2- Is LVM partitioning mandatory for the SO to work ?

3- If I could not apply LVM partitioning on OVH VMs, the manual gpt partitioning of the disk should respect the example of page 61 (pdf page 69) from this documentation ? https://readthedocs.org/projects/securityonion/downloads/pdf/2.3/

4- I imported the ISO image on OVH, but I was not able to launch the installation. Is the ISO image not compatible with OVH ?

5- If none of the above could be causing the problem, what it could be the cause ?

P.S; all the import containers are up and working .

Thank you!

[dougburks]

We haven't tested with OVH. If import works, then in theory you should be able to make standalone work. However, please note that standalone has much higher hardware requirements than import. It's possible that the symptoms you describe could be due to not meeting minimum requirements:
https://docs.securityonion.net/en/2.3/hardware.html

[SaharBerro]

Thank you for your answer.
The VM where the standalone is installed respects minimum requirements:
60 GB RAM
16 vCores (3 GHz)
400 GB SSD
1,000 Mbit/s

could it be the partitioning? Should I try to install it on a CentOS 7 VM ?

[dougburks]

could it be the partitioning?

LVM is not strictly required, just recommended. If you can't do LVM, just make sure you're following the other partitioning recommendations at https://docs.securityonion.net/en/2.3/partitioning.html.

Should I try to install it on a CentOS 7 VM ?

You can certainly try. You may also want to try our new Security Onion 2.4:
https://blog.securityonion.net/2023/08/security-onion-24-has-reached-general.html
https://blog.securityonion.net/2023/08/security-onion-2410-hotfix-20230821-now.html

[SaharBerro]

Thank you for your reply.

I think I understood the problem behind this issue. It was the bond0 interface. If this interface does not exist, the containers so-steno and so-suricata become missing. I have installed SO 2.3 on Centos 7 and compared network configuration files with the SO on ubuntu 20.04.

I will try now to install the SO 2.4.