Very slow reboot

[Alex01000100]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

40

Storage for /

200GB

Storage for /nsm

126G/57G/69G

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hi there,

After I tried to update SO with the "soup" command a message was displayed to reboot the system. I did that with the "reboot" command. I am running SO in the newest VMware workstation player 17.5.0 build-22583795. At the beginning of the start the vm, I got an error message from VM about those sidechannels that are enabled that cause slowness. https://kb.vmware.com/s/article/79832#:~:text=Virtual%20Machines%20that%20have%20side%20channel%20mitigations%20enabled,side%20channel%20attacks%20such%20as%20Spectre%20and%20Meltdown. Unsure, if the slowness could come from that but in "VMware player" I can not disabled them.

In SO, sobridge the port changes from blocking to forwarding to disabled state and then "left promiscuous mode" and then again from the beginning in thousands of cycles. For now, it runs for the whole day and in the past, this was going on for days. I wonder, If I have start again from scratch. However, after fresh installation. Or just use VMware workstation pro 17 on top of win11. The pc itself has really enough capacity and 65GB RAM available.

If anyone has an idea how to improve the speed of this reboot process, let me pls know. Thx.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[Acewiza]

Don't use the VM stuff much so probably not any help here, but I am perplexed. You appear to be attempting to use a dedicated, standalone PC as a Security Onion. Is that correct?

[Alex01000100]

Correct. I am now at 155xxx.xxxxxx and still the same answer to "sudo so-status": system seems to be starting, no highstate has completed since the system has restarted".
The thing is, it has worked for days until I ran "soup".
If I knew, there is no error and this thing (mypc) is just horribly slow, you have to be patient, this would help. I mean it's: Intel(R) Core(TM) i7-8700 CPU @ 3.20GHz 3.19 GHz

[dougburks]

After I tried to update SO with the "soup" command a message was displayed to reboot the system. I did that with the "reboot" command.

You might try updating to the hotfix we released yesterday:
https://blog.securityonion.net/2023/11/security-onion-2430-hotfix-20231117-now.html

If all else fails, you can perform a fresh installation using the latest ISO image.

I am running SO in the newest VMware workstation player 17.5.0 build-22583795. At the beginning of the start the vm, I got an error message from VM about those sidechannels that are enabled that cause slowness. https://kb.vmware.com/s/article/79832#:~:text=Virtual%20Machines%20that%20have%20side%20channel%20mitigations%20enabled,side%20channel%20attacks%20such%20as%20Spectre%20and%20Meltdown. Unsure, if the slowness could come from that but in "VMware player" I can not disabled them.

If this is to be considered a production deployment, then VMware Player on Windows 11 is probably not the best way to do it:
https://docs.securityonion.net/en/2.4/best-practices.html

In SO, sobridge the port changes from blocking to forwarding to disabled state and then "left promiscuous mode" and then again from the beginning in thousands of cycles. For now, it runs for the whole day and in the past, this was going on for days.

These are simply kernel messages and you can avoid them as shown at:
https://docs.securityonion.net/en/2.4/console.html

[Alex01000100]

Excellent, thank you for taking the time to answer. Much appreciate that. Let me keep going.

[Alex01000100]

It works again after I a re-installation with newest version. Thank you!