Elastic Fleet in an inconsistent state

[WPTechnician]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

144GB

Storage for /

200GB

Storage for /nsm

5TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

I recently reinstalled SO to move to 2.4 as we had been happily running 2.3 for a few years. I used the ISO and everything seemed to install cleanly. I installed the manager/search node first and then a sensor node. I am seeing alerts from the playbooks fine but I was getting nothing from the Sensor (Metadata or Suricata). I followed the troubleshooting guide and wasn't able to resolve the issue. I tried restarting the service on the manager and it says it isn't started. When I try to start it, it says that it is already started:

The log files in /opt/so/log/elasticfleet are empty. I am not sure what to do next to get things working. Thanks!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

On your manager what does salt-call state.apply elasticfleet output?

[WPTechnician]

Ugh, I think I made things worse for myself. I uninstalled the Agent on the manager to try and reinstall and it seems it is all just broken. I am going to reinstall everything and go from there. Thanks