Receiving "Request failed with status code 502" on Dashboard, Alerts, Hunt, Cases Screens

[postrow]

Version

2.4.10

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

other (please provide detail below)

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

16GB

Storage for /

250GB

Storage for /nsm

1,015.75 GB / 558.69 GB Free

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues

Detail

Base install of SO v2.4.10 (Hotfix: 20230821) in a Nested ESXi lab environment using VMware port mirroring.
After a week or so of running SO in our lab environment we started receiving "502 Error" messages on the aforementioned pages. This info was pulled from logs within "/opt/so/log/elasticsearch".

[2023-10-03T23:59:07,620][WARN ][org.elasticsearch.cluster.routing.allocation.DiskThresholdMonitor] high disk watermark [85%] exceeded on [J9Dl1_55RK2BWQAEMQL3zw][securityonion][/usr/share/elasticsearch/data] free: 17.3gb[11%], shards will be relocated away from this node; currently relocating away shards totalling [0] bytes; the node is expected to continue to exceed the high disk watermark when these relocations are complete

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Mav1814]

Hello,
It can be about disk space.
Check it .

[postrow]

Thanks for the suggestion - NSM is at 89%

[seyiakilude]

Hi Everyone

I am having issues with adding beats agent to Elasticsearch on Kibaba with the following errors. I have been struggling with it for days

[seyiakilude]

[seyiakilude]

1. I tried modifying the hostgroup firewall setting on securityonion but still not working
2. I cant ping the securityonion server but I can access the Securityonion from the web console
3. I am trying to import netflow data into ELK on Securityonion but I keep receiving connection attempts failed on both port 8220 and 9200

[dougburks]

@seyiakilude Instead of hijacking somebody else's discussion, please start your own discussion at https://securityonion.net/discuss

[seyiakilude]

@dougburks, I am referring to the same server as I am part of the team working with this server. However, I have created another discussion. Thanks

[ponte19]

Same Problem for me, /nsm also nearly full and error 502. What is the solution?

[dougburks]

@ponte19 From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.