PCAP Pending && Incomplete (Continued Discussion from #12689)

[postrow]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

8

RAM

24 GB

Storage for /

500 GB

Storage for /nsm

250GB

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I'm experiencing an identical issue with the PCAP interface as documented in Discussion from #12689.
We restarted so-sensoroni (so-sensoroni-restart) and also cleaned the sensor (so-sensor-clean). The log info contained within /opt/so/log/sensoroni/sensoroni.log shows that the pcap is being processed - but with no results. I attached the log files from (/opt/so/log/soc/sensoroni-server.log) as well as from (/opt/so/log/sensoroni/sensoroni.log) This SO instance is a fresh install of 2.4.40 release. Thanks in advance for any guidance or assistance with resolving this issue.

sensoroni.log

sensoroni.log

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[postrow]

Forgot to mention that all SO services are up and running normally.

Screenshot of the Security Onion PCAP page:

Screenshots Showing the Status of the Security Onion Services: