Deployment failed

[jasonmsg]

Version

2.4.3

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

64GB

Storage for /

1TB

Storage for /nsm

1TB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

ESXI installs Secure Onion, allocating hardware to 32 processing cores, 64GB of RAM, and 1TB of storage. In EVAL deployment mode, so-selastic-fleet missing appears every time, and so-selastic-fleet-package-registry also appears missing every 10 minutes. How to solve it?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

2.4.3 is an old Beta version from many months ago:
https://blog.securityonion.net/2023/07/security-onion-24-beta-4-release-now.html

We've fixed lots of bugs since then:
https://docs.securityonion.net/en/2.4/release-notes.html

Please download the latest version (currently 2.4.30) and see if it works better:
https://securityonion.net/download

[free-viruzdotorg]

(edit - i realized this is a month old, sorry for the reply, but the updated revision is definitely the fixed one after running a reinstall)

This is still an issue
initially it was a certificates missing only, i re ran the setup from the iso again (per the docs) and it got the certificates (this didnt work with a fresh reinstall and i also am on-prem with a super micro server)

after rerunning the install from the iso, it finally resolved itself and is working now

unsure as to how it didnt get the keys and certificates for any of the services with security onion, im puzzled with that. i do have it allowed on the firewall

i wish i took a screenshot of the error, but it was in a similar format of:

Error: missing one or more requisite failed: ssl.influxdb_key
Error: missing one or more requisite failed: ssl.influxdb_crt
Error: missing one or more requisite failed: ssl.redis_crt
Error: missing one or more requisite failed: ssl.redis_key
Error: missing one or more requisite failed: ssl.etc_elasticfleet_crt
Error: missing one or more requisite failed: ssl.etc_elasticfleet_logstash_crt
Error: missing one or more requisite failed: ssl.etc_elasticfleet_logstash_key
Error: missing one or more requisite failed: ssl.etc_elasticfleetlumberjack_crt
Error: missing one or more requisite failed: ssl.etc_elasticfleetlumberjack_key
Error: missing one or more requisite failed: ssl.etc_elasticfleet_agent_crt
Error: missing one or more requisite failed: ssl.etc_elasticfleet_agent_key
Error: missing one or more requisite failed: ssl.etc_filebeat_crt
Error: missing one or more requisite failed: ssl.registry_crt

[dougburks]

Are you saying that you downloaded the latest 2.4.30 ISO image and had the same issue?

If so, what kind of storage do you have (NVME, SSD, or rotational)?

Is your ESXi server perhaps oversubscribed? How many other VMs are competing for disk IO?

Relevant documentation:
https://docs.securityonion.net/en/2.4/best-practices.html#best-practices
https://docs.securityonion.net/en/2.4/hardware.html#virtualization