Cycling Failed state on forwarding nodes

[BSUNetSec]

Greetings,

Just did the upgrade to 2.3.280 and started having an issue. I am seeing all of the forwarding nodes cycle to a fault state. checking the so-status on the forwarding nodes and it looks like the so-zeek is what is cycling a failing state. running docker logs so-zeek and it returned this. Not sure what to do next. We have planned to migrate to 2.4 later this month but would like to keep this one running for the time being.

Thanks

`docker logs so-zeek
checking configurations ...
logger scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

manager scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

proxy scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

worker-1-1 scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

/usr/local/sbin/zeek.sh: line 8: kill: (32) - No such process
checking configurations ...
logger scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

manager scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

proxy scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

worker-1-1 scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

/usr/local/sbin/zeek.sh: line 8: kill: (31) - No such process
checking configurations ...
logger scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

manager scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

proxy scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

worker-1-1 scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

/usr/local/sbin/zeek.sh: line 8: kill: (31) - No such process
checking configurations ...
logger scripts failed.
error in /opt/zeek/share/zeek/policy/securityonion/communityid.zeek, line 24: unknown identifier hash_conn, at or near "hash_conn"

`

[dougburks]

What version were you running before you updated to 2.3.280?

Did you have any custom Zeek configuration or scripts?

[BSUNetSec]

• policy/frameworks/notice/community-id
• policy/protocols/conn/community-id-logging

[dougburks]

That's the new code which is correct. Seems like there is something on your system that is overriding that.

If you run sudo grep -r communityid /opt/so on your manager, what is the output?

[BSUNetSec]

only 1 return

/opt/so/saltstack/local/pillar/zeek/init.sls: - securityonion/communityid

[dougburks]

Looks like somebody modified your Zeek config. Please do the following:

sudo mv /opt/so/saltstack/local/pillar/zeek/init.sls /root/opt-so-saltstack-local-pillar-zeek-init.sls
sudo salt-call state.highstate

Then run the following on a sensor to see if Zeek starts working correctly:

sudo salt-call state.highstate

[BSUNetSec]

Ok that seems to have fixed it. Did a diff on the init.sls in the default and the one moved to root and found

45,46d44
< - policy/frameworks/notice/community-id
< - policy/protocols/conn/community-id-logging
51a50

  - securityonion/communityid

Thanks for all the help