SO system Reboot?

[larry1788]

Dear Security Onion experts
I would like to ask if the SO system has a standard shutdown or reboot procedure, because after the system has been running for a period of time, if it is necessary to restart and use the init6 command to reboot, the system will eventually experience abnormal phenomena, such as the container cannot be started, which is often so- elastalert/so-playbook/Everything is possible. I tried to use the ESXi system or Nutanix's Take Snapshot to perform backup and restore operations, but the results were abnormal and the SO system could not run normally.
So I would like to ask all the experts, is there any way to safely protect the SO system? If the setting is wrong, there is still a chance to restore it and speed up the stable operation of the system.

[reyesj2]

If you can, provide the log files for the services that are not starting. I haven't experience issues rebooting using reboot or powering off a VM using the hypervisors 'shutdown' or 'stop' function.

Typically, when the server is just powering on it does take a bit for all the services to come back to an 'OK' status.

Can you share the VM hardware specs? Are you sure they exceed the minimum for the node type? https://docs.securityonion.net/en/2.4/hardware.html#minimum-specs

[samuel809]

shutdown -r best works for me.
reboot command not recommended. leads to many issues.

[Acewiza]

I'm not really partial to either option.

[https://askubuntu.com/questions/441969/what-is-the-difference-between-reboot-and-shutdown-r]