Problem installing Forward sensor on Almalinux 9

[technox123]

Version

2.4.40

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

64

Storage for /

150gb

Storage for /nsm

2tb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hello,

I'm trying to setup a distributed installation of Security Onion and managed to get the managersearch node all installed fine. All boxes are running the latest version of AlmaLinux 9.3.

However, when moving onto setting up my forward nodes I have encountered an error during installation, please see below:

2024-02-02T16:15:28Z | INFO | Configuring bond interface settings, since this is a not a cloud installation...
net.ipv4.ip_local_reserved_ports = 55000,57314
2024-02-02T16:15:30Z | INFO | Ephemeral ports already reserved
2024-02-02T16:15:30Z | INFO | Clearing the old manager
Importing the security onion GPG key
2024-02-02T16:15:31Z | INFO | Executing command: dnf repolist all
repo id                       repo name                                 status
appstream                     AlmaLinux 9 - AppStream                   disabled
appstream-debuginfo           AlmaLinux 9 - AppStream - Debug           disabled
appstream-source              AlmaLinux 9 - AppStream - Source          disabled
baseos                        AlmaLinux 9 - BaseOS                      disabled
baseos-debuginfo              AlmaLinux 9 - BaseOS - Debug              disabled
baseos-source                 AlmaLinux 9 - BaseOS - Source             disabled
crb                           AlmaLinux 9 - CRB                         disabled
crb-debuginfo                 AlmaLinux 9 - CRB - Debug                 disabled
crb-source                    AlmaLinux 9 - CRB - Source                disabled
epel                          Extra Packages for Enterprise Linux 9 - x disabled
epel-cisco-openh264           Extra Packages for Enterprise Linux 9 ope disabled
epel-cisco-openh264-debuginfo Extra Packages for Enterprise Linux 9 ope disabled
epel-cisco-openh264-source    Extra Packages for Enterprise Linux 9 ope disabled
epel-debuginfo                Extra Packages for Enterprise Linux 9 - x disabled
epel-source                   Extra Packages for Enterprise Linux 9 - x disabled
epel-testing                  Extra Packages for Enterprise Linux 9 - T disabled
epel-testing-debuginfo        Extra Packages for Enterprise Linux 9 - T disabled
epel-testing-source           Extra Packages for Enterprise Linux 9 - T disabled
extras                        AlmaLinux 9 - Extras                      disabled
extras-debuginfo              AlmaLinux 9 - Extras - Debug              disabled
extras-source                 AlmaLinux 9 - Extras - Source             disabled
highavailability              AlmaLinux 9 - HighAvailability            disabled
highavailability-debuginfo    AlmaLinux 9 - HighAvailability - Debug    disabled
highavailability-source       AlmaLinux 9 - HighAvailability - Source   disabled
nfv                           AlmaLinux 9 - NFV                         disabled
nfv-debuginfo                 AlmaLinux 9 - NFV - Debug                 disabled
nfv-source                    AlmaLinux 9 - NFV - Source                disabled
plus                          AlmaLinux 9 - Plus                        disabled
plus-debuginfo                AlmaLinux 9 - Plus - Debug                disabled
plus-source                   AlmaLinux 9 - Plus - Source               disabled
resilientstorage              AlmaLinux 9 - ResilientStorage            disabled
resilientstorage-debuginfo    AlmaLinux 9 - ResilientStorage - Debug    disabled
resilientstorage-source       AlmaLinux 9 - ResilientStorage - Source   disabled
rt                            AlmaLinux 9 - RT                          disabled
rt-debuginfo                  AlmaLinux 9 - RT - Debug                  disabled
rt-source                     AlmaLinux 9 - RT - Source                 disabled
sap                           AlmaLinux 9 - SAP                         disabled
sap-debuginfo                 AlmaLinux 9 - SAP - Debug                 disabled
sap-source                    AlmaLinux 9 - SAP - Source                disabled
saphana                       AlmaLinux 9 - SAPHANA                     disabled
saphana-debuginfo             AlmaLinux 9 - SAPHANA - Debug             disabled
saphana-source                AlmaLinux 9 - SAPHANA - Source            disabled
sundive-alma9-appstream       AlmaLinux 9 - AppStream                   enabled
sundive-alma9-baseos          AlmaLinux 9 - BaseOS                      enabled
sundive-alma9-epel            Extra Packages for Enterprise Linux 9 - x enabled
sundive-alma9-extras          AlmaLinux 9 - Extras                      enabled
sundive-azure-cli             Azure CLI                                 enabled
2024-02-02T16:15:31Z | INFO | Installing Salt
2024-02-02T16:15:31Z | INFO | Executing command: dnf -y install salt-3006.5 salt-minion-3006.5
Last metadata expiration check: 3:39:34 ago on Fri 02 Feb 2024 12:35:57 UTC.
No match for argument: salt-3006.5
No match for argument: salt-minion-3006.5
Error: Unable to find a match: salt-3006.5 salt-minion-3006.5
2024-02-02T16:15:31Z | INFO | Executing command: mkdir -p /etc/salt/minion.d
2024-02-02T16:15:31Z | INFO | Executing command: salt-pip install docker --no-index --only-binary=:all: --find-links files/salt_module_deps/docker/
./so-functions: line 40: salt-pip: command not found
2024-02-02T16:15:31Z | INFO | Executing command: salt-pip install pymysql --no-index --only-binary=:all: --find-links files/salt_module_deps/pymysql/
./so-functions: line 40: salt-pip: command not found
2024-02-02T16:15:31Z | INFO | Configuring minion type as sensor
2024-02-02T16:15:31Z | INFO | Running: salt-call state.apply salt.mine_functions --local --file-root=../salt/ -l info pillar='{host: {mainint: eno1}}'
./so-functions: line 538: salt-call: command not found
2024-02-02T16:15:31Z | INFO | Not an appliance
2024-02-02T16:15:31Z | INFO | Executing command: salt-call state.apply setup.highstate_cron --local --file-root=../salt/
./so-functions: line 40: salt-call: command not found
2024-02-02T16:15:31Z | INFO | Verifying setup
WARNING: Errors detected during setup.
--------- ERRORS ---------
Failed to stop salt-minion.service: Unit salt-minion.service not loaded.
Failed to enable unit: Unit file salt-minion.service does not exist.
Failed to enable unit: Unit file salt-minion.service does not exist.
Failed to restart salt-minion.service: Unit salt-minion.service not found.
Failed to restart salt-minion.service: Unit salt-minion.service not found.
--------------------------

Does anyone have any idea what may be going wrong? Manually trying to install salt-3006.5 and salt-minion-3006.5 using that command came back with the same exact error messages.

No match for argument: salt-3006.5
No match for argument: salt-minion-3006.5
Error: Unable to find a match: salt-3006.5 salt-minion-3006.5

Am I missing a repo?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[TOoSmOotH]

We have never tested on Alma. I would recommend using the ISO.

[technox123]

Thanks for the reply, I managed to get it sorted by adding the Docker, Salt, and Security Onion repositories manually into the repo list. A part from that, everything works perfect.