Installation ended abruptly with ERROR: StreamClosedException

[SurinameClubcard]

Version

2.4.60

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32 GB

Storage for /

162 GB

Storage for /nsm

320 GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I did a clean install using the ISO, version 2.4.60. Installation failed (last couple of lines of /root/sosetup.log:

Importing Plays - NOTE: this will continue after installation finishes and could take an hour or more. Rebooting while the import is in progress will delay playbook imports.
2024-04-08T20:59:57Z | INFO | Enabling checkin at boot
2024-04-08T21:00:19Z | INFO | Executing command: salt-call schedule.enable -linfo --local
[INFO    ] Creating module dir '/var/cache/salt/minion/extmods/grains'
[INFO    ] Syncing grains for environment 'base'
[INFO    ] Loading cache from salt://_grains, for base
[INFO    ] Caching directory '_grains/' for environment 'base'
[ERROR   ] Encountered StreamClosedException
local:
    ----------
    changes:
        ----------
    comment:
    result:
        True
2024-04-08T21:00:22Z | INFO | Verifying setup
WARNING: Errors detected during setup.
--------- ERRORS ---------
[ERROR   ] Encountered StreamClosedException
--------------------------

I couldn't find the root cause of that problem then. Eventually rebooted.

After a reboot, salt-call state.highstate returns no problems. so-status shows all services running:

                       Security Onion Status
                         Container │ Status  │             Details
───────────────────────────────────┼─────────┼─────────────────────
                 so-dockerregistry │ running │           Up 2 days
                     so-elastalert │ running │           Up 2 days
                  so-elastic-fleet │ running │           Up 2 days
 so-elastic-fleet-package-registry │ running │ Up 2 days (healthy)
                  so-elasticsearch │ running │           Up 2 days
                       so-idstools │ running │           Up 2 days
                       so-influxdb │ running │ Up 2 days (healthy)
                         so-kibana │ running │           Up 2 days
                         so-kratos │ running │           Up 2 days
                       so-logstash │ running │           Up 2 days
                          so-mysql │ running │ Up 2 days (healthy)
                          so-nginx │ running │ Up 2 days (healthy)
                       so-playbook │ running │           Up 2 days
                          so-redis │ running │           Up 2 days
                      so-sensoroni │ running │           Up 2 days
                            so-soc │ running │           Up 2 days
                       so-soctopus │ running │           Up 2 days
                          so-steno │ running │           Up 2 days
                so-strelka-backend │ running │         Up 45 hours
            so-strelka-coordinator │ running │           Up 2 days
             so-strelka-filestream │ running │           Up 2 days
               so-strelka-frontend │ running │           Up 2 days
             so-strelka-gatekeeper │ running │           Up 2 days
                so-strelka-manager │ running │           Up 2 days
                       so-suricata │ running │         Up 21 hours
                       so-telegraf │ running │           Up 2 days
                           so-zeek │ running │ Up 2 days (healthy)

Is my installation okay? Maybe some containers are completely missing and therefore not reported at all? Should I re-install?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[robbiemarshall]

All your containers are present and running, so it looks ok. Are you seeing any issues on the Grid page in SOC?