Is it possible to demote a Distributed Manager Search node to just a Manager Node? So that i can add multiple receiver nodes, but keep all my work?

[Bal33p]

Version

2.4.30

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

configuration

Installation Type

Distributed

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

250

Storage for /nsm

30tb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

more than 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

With the distributed Manager Search node the receiver node failed highstate with multiple docker errors.
Example

      ID: so-redis
Function: docker_container.running
  Result: False
 Comment: Failed to pull sosewrver:5000/security-onion-solutions/so-redis:2.4.30: Error 404: manifest for soserver:5000/security-onion-solutions/so-redis:2.4.30 not found: manifest unknown: manifest unknown
 Started: 20:24:07.493424
Duration: 74.647 ms
 Changes:

If it is not possible to use a receiver node with a manager search node, is it possible to demote the MS to just a manager so that I can bolt on multiple receivers?

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[TOoSmOotH]

Receiver nodes do not run elasticsearch. What are you really trying to do? It makes no sense to add redundancy to the pipeline if you don't have multiple search nodes. Receiver nodes are for pipeline redundancy.

[dougburks]

we are looking to offset some of the compute to a separate receiver, expecting to see better performance on the manager search node while running searches ( I reserve the right to be wrong with this thinking :)

It seems like you may be confusing search nodes and receiver nodes.

From https://docs.securityonion.net/en/2.4/architecture.html#search-node:

From https://docs.securityonion.net/en/2.4/architecture.html#receiver-node:

[Bal33p]

OK,
This goes back to my original question is it possible to use a Receiver and Search node with a Distributed Manger+Search Node
or do i need to breake the Manager Search node apart now to be able to expand?
the below diagram is what I am attempting to build. Will this work?

If the answer to the above question ius yes can someon help me trouble shoot the fact that the current Reciever Node i added to my cluster wont start the containers
[https://github.com//discussions/11975]

Current Receiver Node Status

#11975 (comment)

I am sorry , i have turned this all into a mess it seems

[kvkamin]

Make sure docker is started.
systemctl <status/start> docker

If docker is running, the containers should start.

[Bal33p]

[TOoSmOotH]

When you run a highstate from one of the receiver nodes does it complete?

[Bal33p]

Fails with four errors shown below..

      ID: so-sensoroni
Function: docker_container.running
  Result: False
 Comment: Failed to pull orseconip01:5000/security-onion-solutions/so-soc:2.4.30: Error 404: manifest for orseconip01:5000/security-onion-solutions/so-soc:2.4.30 not found: manifest unknown: manifest unknown
 Started: 15:16:05.729938
Duration: 73.143 ms
 Changes:

---

      ID: so-telegraf
Function: docker_container.running
  Result: False
 Comment: Failed to pull orseconip01:5000/security-onion-solutions/so-telegraf:2.4.30: Error 404: manifest for orseconip01:5000/security-onion-solutions/so-telegraf:2.4.30 not found: manifest unknown: manifest unknown
 Started: 15:16:06.304147
Duration: 64.593 ms
 Changes: 

---

      ID: so-logstash
Function: docker_container.running
  Result: False
 Comment: Failed to pull orseconip01:5000/security-onion-solutions/so-logstash:2.4.30: Error 404: manifest for orseconip01:5000/security-onion-solutions/so-logstash:2.4.30 not found: manifest unknown: manifest unknown
 Started: 15:16:08.258483
Duration: 70.008 ms
 Changes: 

---

      ID: so-redis
Function: docker_container.running
  Result: False
 Comment: Failed to pull orseconip01:5000/security-onion-solutions/so-redis:2.4.30: Error 404: manifest for orseconip01:5000/security-onion-solutions/so-redis:2.4.30 not found: manifest unknown: manifest unknown
 Started: 15:16:09.514269
Duration: 68.849 ms
 Changes:   

---

Summary for local

Succeeded: 191 (changed=9)
Failed: 4

Total states run: 195
Total run time: 19.995 s

[TOoSmOotH]

try so-docker-refresh on the manager. If that doesn't fix it make sure there is connectivity from the receiver to the manager on port 5000: nc -vz manager 5000

[Bal33p]

LOL after all that. Docker refresh fixed it. Thank you for your help