Zeek Illegal instruction

[giomke]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

4

RAM

16

Storage for /

163

Storage for /nsm

327

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi. Zeek does not work, I am getting the following errors

sudo docker logs so-zeek
checking configurations ...
logger scripts failed.
/opt/zeek/share/zeekctl/scripts/check-config: line 50:    19 Illegal instruction     (core dumped) ZEEKCTL_DISABLE_LISTEN=1 ZEEKCTL_CHECK_CONFIG=1 "${zeek}" $check_option "$@"

manager scripts failed.
/opt/zeek/share/zeekctl/scripts/check-config: line 50:    22 Illegal instruction     (core dumped) ZEEKCTL_DISABLE_LISTEN=1 ZEEKCTL_CHECK_CONFIG=1 "${zeek}" $check_option "$@"

proxy scripts failed.
/opt/zeek/share/zeekctl/scripts/check-config: line 50:    26 Illegal instruction     (core dumped) ZEEKCTL_DISABLE_LISTEN=1 ZEEKCTL_CHECK_CONFIG=1 "${zeek}" $check_option "$@"

worker-1-1 scripts failed.
/opt/zeek/share/zeekctl/scripts/check-config: line 50:    25 Illegal instruction     (core dumped) ZEEKCTL_DISABLE_LISTEN=1 ZEEKCTL_CHECK_CONFIG=1 "${zeek}" $check_option "$@"

Hint: Run the zeekctl "deploy" command to get started.
stopping worker ...
stopping proxy ...
stopping manager ...
stopping logger ...
checking configurations ...

First I thought it was due to ESXI CPU emulator.
I tried a bunch of different setting but did not worked.

After that I ran soup but the problem remained.
When I am running sudo so-checkin is working properly

Suricata generates alerts, but zeek does not work.

Do you have any clue guise I am out of ideas? I set up from scratch at list 10 times but I did not manage to resolve this issue

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[dougburks]

First I thought it was due to ESXI CPU emulator.
I tried a bunch of different setting but did not worked.

This is a known issue for Proxmox and you may be experiencing something similar on ESXi.

From https://docs.securityonion.net/en/2.4/proxmox.html#cpu:
Proxmox defaults to a VM CPU which may not include all of the features of your host CPU. You may need to change this to host to pass through the host CPU type.

[giomke]

Do you have any recommendations how to resolve the issue

[giomke]

We are using ESXi 7.0

in ESXi 6.7 works properly

[dougburks]

Per my response above, is the VM set to a specific CPU type? Have you tried changing the CPU type?