Security Onion 2.4 - SOC Missing under so-status

[smallboy69]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

20

RAM

256gb

Storage for /

9TB

Storage for /nsm

9TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

hi Community

so i installed 2.4.30 on dec 8 on Oracle 9.3 via downloaded ISO image and it was all working fine services

just recently i notice so-soc saying missing

have attached the logs and only symptom i can see is initialization error

appreciate your insight and experience as experts on Security onion

Thanks
**edited to remove file

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[TOoSmOotH]

Please use a text file or a gist for the logs. Word docs don't get opened.

[smallboy69]

please find attached error message in portion of log
Uploading sensoroni-server-20231219-Event.txt…

[dougburks]

@smallboy69 That hyperlink just points to this discussion:

https://github.com/Security-Onion-Solutions/securityonion/discussions/12057

[smallboy69]

My apologise @dougburks

new to using GitHub and did not verify correct link after i posted it.

my mistake

[sensoroni-server-20231219-Event.txt]
(https://github.com/Security-Onion-Solutions/securityonion/files/13746361/sensoroni-server-20231219-Event.txt)

[jertel]

Hi @smallboy69, it looks like a corrupted job file. Try removing this file from your manager node: /nsm/soc/jobs/internalso/1002.json.

[smallboy69]

thanks @jertel will action it and see if it resolves the issue

regards

[smallboy69]

Thanks @jertel it works

Much appreciated