problem while trying to update 2.4.30 connection reset by peer cause a lot of problem.

[newbdoc]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

160

Storage for /

180GB

Storage for /nsm

2TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

It all started with a 2.4.30 update last week. Following the update I had the same error as #11789.
I did not have a file /opt/so/saltstack/local/salt/zeek/defaults.yaml (even in the backups, example from October 31, this file is not present. I therefore tried the command so-saltstack-update, without success.

soup.log indicates several connection reset by peer errors, several template update errors example "Component template does not exist for logs-cisco_umbrella.log. The index template will not be loaded. Load failures: 11"
i have tried to manually so-docker-refresh, so-repos-sync, without success and the same error in /opt/so/log/salt/master :
Nov 17 19:07:00 bitchy salt-master[2100]: [ERROR ] Specified SLS 'zeeklogs' in environment 'base' is not available on the salt master
Nov 17 19:07:00 bitchy salt-master[2100]: [ERROR ] Template was specified incorrectly: False
Nov 17 19:07:00 bitchy salt-master[2100]: [ERROR ] Specified SLS 'global' in environment 'base' is not available on the salt master
Nov 17 19:07:00 bitchy salt-master[2100]: [ERROR ] Template was specified incorrectly: False
Nov 17 19:07:00 bitchy salt-master[2100]: [CRITICAL] Pillar render error: Specified SLS 'data.*' in environment 'base' is not available on the salt master
Nov 17 19:07:00 bitchy salt-master[2100]: [CRITICAL] Pillar render error: Specified SLS 'zeeklogs' in environment 'base' is not available on the salt mas>
Nov 17 19:07:00 bitchy salt-master[2100]: [CRITICAL] Pillar render error: Specified SLS 'global' in environment 'base' is not available on the salt master

I replaced the files /opt/so/saltstack/default/pillar/top.sls , /opt/so/saltstack/default/salt/top.sls with those from a backup from October 31 (same version as security onion repos), which seems to have corrected the errors.
salt-master[2100]: [CRITICAL] Pillar render error: Specified SLS 'zeeklogs' in environment 'base' is not available on the salt mas>

i didn't find information about how to restore config files from backup and i have no idea what to look for.
any help is appreciated !

here output of few command.

[labsop@bitchy backup-2023-11-17_systemfails]# sudo systemctl status salt-master
● salt-master.service - The Salt Master Server
Loaded: loaded (/usr/lib/systemd/system/salt-master.service; enabled; preset: disabled)
Active: active (running) since Wed 2023-11-22 01:35:23 UTC; 9min ago
Docs: man:salt-master(1)
file:///usr/share/doc/salt/html/contents.html
https://docs.saltproject.io/en/latest/contents.html
Main PID: 1354250 (/opt/saltstack/)
Tasks: 32 (limit: 1027416)
Memory: 418.1M
CPU: 56.788s
CGroup: /system.slice/salt-master.service
├─1354250 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master MainProcess"
├─1354592 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master PubServerChannel._publish_daemon"
├─1354593 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master EventPublisher"
├─1354600 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master Engine(salt.loaded.ext.engines.checkmine)"
├─1354601 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master Maintenance"
├─1354602 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer ReqServer_ProcessManager"
├─1354603 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorkerQueue"
├─1354604 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorker-0"
├─1354605 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorker-1"
├─1354609 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorker-2"
├─1354610 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master FileServerUpdate"
├─1354618 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorker-3"
└─1354620 "/opt/saltstack/salt/bin/python3.10 /usr/bin/salt-master ReqServer MWorker-4"

Nov 22 01:41:36 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014136573373
Nov 22 01:42:37 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014237333108
Nov 22 01:42:38 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014237713160
Nov 22 01:42:39 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014238829265
Nov 22 01:43:39 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014339638660
Nov 22 01:43:40 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014340042988
Nov 22 01:43:41 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014341174117
Nov 22 01:44:42 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014442015451
Nov 22 01:44:42 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014442392431
Nov 22 01:44:43 bitchy salt-master[1354600]: [INFO ] Runner completed: 20231122014443500947

[labsop@bitchy backup-2023-11-17_systemfails]# sudo so-status
⌛ System appears to be starting. No highstate has completed since the system was restarted.
[labsop@bitchy backup-2023-11-17_systemfails]#

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[peanutyost]

Im having the same error after a update.

[dougburks]

@peanutyost From #1720:

Start a new discussion instead of replying to somebody else's discussion
Please search to see if you can find similar discussions that may help you. However, in order to avoid confusion, please do NOT reply to somebody else's discussion with your own issue. Instead, please start a new discussion and in that new discussion you can provide a hyperlink to the related discussion.