No Logs in SO and Kibana Despite Functional Services

[Skwert]

Version

2.4.30

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

32

Storage for /

250

Storage for /nsm

100

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm facing an issue where logs are not appearing in SO and Kibana, even though all services seem to be operational. I've tested the interface designated for traffic monitoring using tcpdump. As a newcomer, I might be missing something obvious. Could someone please provide guidance on troubleshooting steps or potential reasons for the absence of logs in SO? Any help is greatly appreciated. Thank you!

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[cm-ops]

What does the command elastic-agent status show?

[Skwert]

┌─ fleet
│ └─ status: (FAILED) fail to checkin to fleet-server: all hosts failed: 2 errors occurred:
│ * requester 0/2 to host https://xxx:8220/ errored: Post "https://xxxx:8220/api/fleet/agents/b97e28bd-e18b-4662-b62a-86264b5b4b75/checkin?": x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "dc1-test-securityonion001")
│ * requester 1/2 to host https://dc1-test-securityonion001:8220/ errored: Post "https://dc1-test-securityonion001:8220/api/fleet/agents/b97e28bd-e18b-4662-b62a-86264b5b4b75/checkin?": x509: certificate signed by unknown authority (possibly because of "crypto/rsa: verification error" while trying to verify candidate authority certificate "dc1-test-securityonion001")
│
│
└─ elastic-agent

[cm-ops]

Check you Fleet Server from SOC tools. It looks like there is an issue connecting. What does it show?