Package Registry Container Missing

[rlberry]

Version

2.4.50

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

165gb

Storage for /nsm

333gb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Several days after a fresh install of SO 2.4.50, after a reboot, I get a fault in Grid saying so-elastic-fleet-package-registry is missing. Running sudo salt-call state.highstate returns a single error:

ID: so-elastic-fleet-package-registry
    Function: docker_container.running
      Result: False
     Comment: Created container 'so-elastic-fleet-package-registry'. Failed to start container 'so-elastic-fleet-package-registry': 'Error 500: driver failed programming external connectivity on endpoint so-elastic-fleet-package-registry (4d8997eedf2ed41e813dc67df33355f7293fbf36d2eac0906daefcd86c1974e5): Error starting userland proxy: listen tcp4 0.0.0.0:8080: bind: address already in use'.
     Started: 14:00:13.989406
    Duration: 690.977 ms
     Changes:
              ----------
              container:
                  ----------
                  Networks:
                      ----------
                      bridge:
                          ----------
                          IPConfiguration:
                              ----------
                              new:
                                  not connected
                              old:
                                  automatic
                      sobridge:
                          ----------
                          Aliases:
                              ----------
                              new:
                                  - 79ad8c1708f0
                              old:
                                  None
                          IPAMConfig:
                              ----------
                              new:
                                  ----------
                                  IPv4Address:
                                      172.17.1.44
                              old:
                                  None
              container_id:
                  ----------
                  added:
                      79ad8c1708f0cabf43f614fbf759b0d748430e3971f271b0af8313de1899c6b2

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Is there some other process using port 8080?

[rlberry]

Not that I am tracking, I have not added anything to the Security Onion install, and made no port changes in the configurations.

[cm-ops]

netstat -tulpn | grep 8080 then use ps to see what process is using port 8080.

[rlberry]

The netstat returns
**tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 36386/docker-proxy**

and the PS on that process yields

36386 ? Sl 0:00 /usr/bin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 8080 -container-ip 172.17.1.44 -container-port 8080

When I booted it up today, the so-elastic-fleet-package-registry was showing, but the Elastisearch was showing as "pending". I think I have a fix for that floating around.

[cm-ops]

You are probably seeing this https://docs.securityonion.net/en/2.4/release-notes.html#known-issues