Problem Installing 2.4 on Proxmox

[bumfighter]

Version

2.4.3

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

6

RAM

16

Storage for /

500

Storage for /nsm

900

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I've tried installing Security Onion multiple times from different versions of 2.4 for the last few months on my proxmox server. Every time I've tried the installation always fails. I reboot and so-status will show everything green but there will never be any network traffic logs.

Guidelines

• I have read the above statement and can confirm my post is relevant to Security Onion 2.4.

[reyesj2]

Every time I've tried the installation always fails.

Can you provide any logs or the error given when the installation fails? /root/errors.log and /root/sosetup.log are helpful to troubleshoot

[bumfighter]

Here are the screenshots of both of those logs. Doesn't really give much to go off of it seems.

[reyesj2]

so-status shows all services are green, but you still have no logs in SOC? There is button on the grid page that allows you to test traffic ingest on your sensor. https://docs.securityonion.net/en/2.4/grid.html#icons-in-lower-left-corner

[bumfighter]

This is the error I get but if I switch to the hunt interface it looks like I do have some logs populating with the standalone as the source http. I noticed the sniffing interface I have for SO has an IP assigned for some reason. Would this be causing a potential issue?

Also, I just did a tcpdump on that same sniffing interface via the standalone cli and it shows all the correct traffic but not logs get created in SOC.

[reyesj2]

Your sniffing interface should not have an IP assigned. You should remove it and run sudo so-monitor-add on the sensor and make sure it is actually assigned as a sniffing interface.

[bumfighter]

I deleted the ip assigned to the interface and performed so-monitor-add to the same interface and the above is what I get. Does the "MTU greater than maximum" error have a solution?

[bumfighter]

I say this because there aren't any network logs being produced in kibana or anywhere else.

[isaacgolding]

I had a similar issue with proxmox early on. The issue might be that your dont have promisc turned on in the /etc/network/interfaces file see this discussion here #8245