No Data Showing for Alerts

[anitatata]

Hello, I have Security Onion Version: 2.3.260.
3 months ago, on the alerts tab there was a data displayed.

However, if I want to display data from 2 months ago or even 1 hour ago in the alerts tab, the data doesn't appear.

Even if I check the log /nsm/wazuh/logs/alerts/alerts.log there is a log coming in.

Here's so-status.

I'm not too familiar with onion security, is there anything I can check?

Thanks

[bienio20]

I have same issue with v2.4. After installation no Alerts at all even after test command.
I don't want start new topic but run this command : "sudo so-rule" in my case it shows this:

(This should not happen, the system is in an error state if you see this message .)

More than one manager-type pillar exists, minion id's listed below:
"/opt/so/saltstack/local/pillar/minions/adv_securityonion_import.sls", "/opt/s o/saltstack/local/pillar/minions/securityonion_import.sls"

So, so far I just deleted one the not necessary one with no configuration by using command:

rm -rf /opt/so/saltstack/local/pillar/minions/adv_securityonion_import.sls

Now, when run "sudo so-rule" I have no same alert. Still working on that.

[dougburks]

@bienio20 From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.

When you start your new discussion, please do so at https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4 since you are using 2.4.

[GiveHimNoRest]

I'm experiencing the same issue as well. I'm trying to set up and install Security Onion 2.4 on Windows 10 Pro using Oracle Virtual Box. I've tried installing it with various settings multiple times, but I still haven't received a valid alert.

[dougburks]

@GiveHimNoRest From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.

When you start your new discussion, please do so at https://github.com/Security-Onion-Solutions/securityonion/discussions/categories/2-4 since you are using 2.4.

[dougburks]

@anitatata

From #1720:

Please include the following details where you can:

• How many nodes do you have?
• What are the hardware specs of each of those nodes?
• How are each of those nodes configured? (ex. manager with 2 search nodes and 3 forward nodes)
• Do you get any failures when you run sudo salt-call state.highstate?
• Does the SOC Grid page show any failures?
• Provide applicable logs. If you are having problems right after setup, provide /root/sosetup.log. If you are having problems during soup, provide /root/soup.log. If you are having problems with a specific component, provide that component's logs from /opt/so/log/.

[anitatata]

Hello Doug, thanks for replying.
Sorry I'm not to familiar with seconion, so this the answer.

1. How many nodes do you have?

Only 1 nodes (1 server)

2. What are the hardware specs of each of those nodes?

It use 8cpu and 16GB of RAM

3. Do you get any failures when you run sudo salt-call state.highstate?
   

4. Does the SOC Grid page show any failures?

No, below capture:

5. Provide applicable logs. If you are having problems right after setup, provide /root/sosetup.log. If you are having problems during soup, provide /root/soup.log. If you are having problems with a specific component, provide that component's logs from /opt/so/log/.

Actually I check on kibana.log there is no log. Can you suggest what log that I should check?

Thanks

[dougburks]

Before we get too far into troubleshooting, have you tried rebooting?

If the problem continues after a reboot, then it may be a problem in the log pipeline. In that case, check the logs in the following directories for additional clues:
/opt/so/log/elasticsearch/
/opt/so/log/filebeat/
/opt/so/log/logstash/
/opt/so/log/redis/

Also, what is the output of the following?

sudo du --max-depth=1 -h /nsm

[anitatata]

Yes, I tried many times reboot but it still same.

There is log in /opt/so/log/elasticsearch, said that its reach maximum shards

/opt/so/log/filebeat

In logstash, there is same log that said it reach maximum shards/opt/so/log/logstash

and there is no error in redis.

Below is the output for du --max-depth=1 -h /nsm

Thanks

[dougburks]

If you've reached maximum shards, then you'll need to lower your number of open shards:
https://docs.securityonion.net/en/2.3/elasticsearch.html?#shards

You might need to close or delete some old indices:
https://docs.securityonion.net/en/2.3/elasticsearch.html?#closing-indices