Replies: 6 comments 10 replies
-
|
Have you checked the redis and elasticsearch logs for additional clues? |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks : thanks for reply ////////////////// samples of log on logstash.log file ////////////////////////// and here is sample of redis.log file and here is sample of elasticsearch .log file |
Beta Was this translation helpful? Give feedback.
-
|
Logstash is having trouble connecting to Redis. Usually, there are additional clues in the redis and/or elasticsearch logs. Have you made any changes to your configuration? You state in your original post that there are salt failures. What are those salt failures? |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks also, no salt failure |
Beta Was this translation helpful? Give feedback.
-
|
Logstash is having trouble connecting to Redis. If you can't find additional clues as to why in the logs, then perhaps it's time to try a fresh installation from the latest 2.4.70 ISO image. |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks //////////////////////// samples of Logstash //////////////// You are using a deprecated config setting "ssl_verify_mode" set in beats. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Set 'ssl_client_authentication' instead. If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=>"ssl_verify_mode", :plugin=><LogStash::Inputs::Beats ssl_certificate=>"/usr/share/logstash/elasticfleet-logstash.crt", ssl_key=>"/usr/share/logstash/elasticfleet-logstash.key", ssl_verify_mode=>"force_peer", port=>5055, id=>"90e20e20e792a51724bfcf082d31b06c648ebd5ffb549e779e4be1b8ea49190f", ssl=>true, tags=>["elastic-agent", "input-sec-onion"], ssl_certificate_authorities=>["/usr/share/filebeat/ca.crt"], ecs_compatibility=>:v8, enable_metric=>true, debug=>false, codec=><LogStash::Codecs::Plain id=>"plain_1439dda8-b3c4-41a0-bd13-d56218a8048b", enable_metric=>true, charset=>"UTF-8">, host=>"0.0.0.0", ssl_enabled=>false, ssl_client_authentication=>"none", ssl_peer_metadata=>false, include_codec_tag=>true, ssl_handshake_timeout=>10000, ssl_cipher_suites=>["TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", "TLS_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256"], ssl_supported_protocols=>["TLSv1.2", "TLSv1.3"], client_inactivity_timeout=>60, executor_threads=>4, add_hostname=>false, tls_min_version=>1, tls_max_version=>1.3>} ////////////////////////////////////////////// i configured the SO to listen the Fortigate FW log on port 9004 but on the above sample of log i have seen the listening on port 5055 till now i didn't see any alert or event on the SO Dashboards |
Beta Was this translation helpful? Give feedback.
-
|
i found the below events on the Dashboard failed to get udp stats from /proc: /proc/net/udp entry not found for [00000000:232C 
i saerched on the google with this error message "failed to get udp stats from /proc: /proc/net/udp entry not found for [00000000:232C" and found the below
i executed the same command and the output is : 
really , i didn't understand what is the issue ? |
Beta Was this translation helpful? Give feedback.
-
Was there nothing inside of /opt/so/log/elasticfleet/elastic-agent-*? |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks i browse the content of one of them , here are samples of the output 
|
Beta Was this translation helpful? Give feedback.
-
|
What is the output of the following?
Where did you add the integration? If you added it to the Fleet server policy, you won't see output because it would be running inside of the Fleet container. In this case, there would be no way to route the traffic to the agent in the container. If this is what happened, you will need to move the integration to another policy, like the general policy. Otherwise, Elastic Agent on the Security Onion machine should report it is listening. |
Beta Was this translation helpful? Give feedback.
-
|
@weslambert |
Beta Was this translation helpful? Give feedback.
-
|
@dougburks : appreciate your assistance |
Beta Was this translation helpful? Give feedback.
Uh oh!
There was an error while loading. Please reload this page.
-
Version
2.4.50
Installation Method
Security Onion ISO image
Description
configuration
Installation Type
Standalone
Location
on-prem with Internet access
Hardware Specs
Meets minimum requirements
CPU
6
RAM
24
Storage for /
500
Storage for /nsm
200 GB
Network Traffic Collection
other (please provide detail below)
Network Traffic Speeds
1Gbps to 10Gbps
Status
Yes, all services on all nodes are running OK
Salt Status
Yes, there are salt failures (please provide detail below)
Logs
Yes, there are additional clues in /opt/so/log/ (please provide detail below)
Detail
HI
i had sent the log of FG FW with IOS version 7, the log received on the interface when i executed the tcpdump . but when i browse the alerts or Dashboards on SO no events or alert there. I checked if there is drop log via the kernel but there is no dropping.
i browse the content of the logstash.log file and i found the below error
all services and agents are healthy and running.
//////////////////////////////// Logstash.log /////////////////////////////////
client_loop: send disconnect: Connection reseter ] SIGTERM received. Shutting down.
[2024-05-26T06:57:47,863][WARN ][logstash.inputs.redis ] Redis connection error {:message=>"Error connecting to Redis on hsa-so:9>
[logstash.inputs.redis ] Redis connection error {:message=>"Error connecting to Redis on hsa-so:9>[2024-05-26T06:57:47,864][WARN ][logstash.inputs.redis ] Redis connection error {:message=>"Error connecting to Redis on hsa-so:9>[2024-05-26T06:57:47,864][WARN ][logstash.inputs.redis ] Redis connection error {:message=>"Error connecting to Redis on hsa-so:9>[2024-05-26T06:57:50,835][INFO ][logstash.javapipeline ] Pipeline terminated {"pipeline.id"=>"search"}
[2024-05-26T06:57:51,417][INFO ][logstash.pipelinesregistry] Removed pipeline from registry successfully {:pipeline_id=>:search}
[2024-05-26T06:57:51,663][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:51,668][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T06:57:52,689][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:52,690][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T06:57:53,693][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:53,693][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T06:57:54,704][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:54,704][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T06:57:55,707][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:55,708][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T06:57:56,712][WARN ][logstash.outputs.redis ] Failed to flush outgoing items {:outgoing_count=>50, :exception=>"Redis:>[2024-05-26T06:57:56,712][WARN ][logstash.outputs.redis ] Failed to send backlog of events to Redis {:identity=>"redis://[2024-05-26T07:06:58,824][INFO ][logstash.runner ] Log4j configuration path used is: /usr/share/logstash/config/log4j2.prop>[2024-05-26T07:06:58,837][INFO ][logstash.runner ] Starting Logstash {"logstash.version"=>"8.10.4", "jruby.version"=>"jruby>[2024-05-26T07:06:58,840][INFO ][logstash.runner ] JVM bootstrap flags: [-Dlog4j2.formatMsgNoLookups=true, -Xms1000m, -Xmx1>[2024-05-26T07:07:03,216][INFO ][logstash.agent ] Successfully started Logstash API endpoint {:port=>9600, :ssl_enabled=>f>[2024-05-26T07:07:05,675][INFO ][org.reflections.Reflections] Reflections took 442 ms to scan 1 urls, producing 132 keys and 464 val>[2024-05-26T07:07:06,843][WARN ][logstash.inputs.http ] You are using a deprecated config setting "ssl_verify_mode" set in http.>[2024-05-26T07:07:06,850][WARN ][logstash.inputs.http ] You are using a deprecated config setting "ssl" set in http. Deprecated >[2024-05-26T07:07:07,239][WARN ][logstash.inputs.beats ] You are using a deprecated config setting "ssl_verify_mode" set in beats>[2024-05-26T07:07:07,266][WARN ][logstash.inputs.beats ] You are using a deprecated config setting "ssl" set in beats. Deprecated>[2024-05-26T07:07:07,271][WARN ][logstash.outputs.elasticsearch] You are using a deprecated config setting "ssl_ce
2024-05-26T07:07:08,186][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[>[2024-05-26T07:07:09,488][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://so_elastic:xxxxx>[2024-05-26T07:07:09,527][INFO ][logstash.outputs.elasticsearch] Elasticsearch version determined (8.10.4) {:es_version=>8}
[2024-05-26T07:07:09,527][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the type event field won't be u>[2024-05-26T07:07:09,592][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch>[2024-05-26T07:07:09,592][WARN ][logstash.outputs.elasticsearch] You have enabled encryption but DISABLED certificate verification, >[2024-05-26T07:07:09,598][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[>[2024-05-26T07:07:09,709][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://so_elastic:xxxxx>[2024-05-26T07:07:09,721][INFO ][logstash.outputs.elasticsearch] Elasticsearch version determined (8.10.4) {:es_version=>8}
[2024-05-26T07:07:09,722][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the type event field won't be u>[2024-05-26T07:07:09,760][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch>[2024-05-26T07:07:09,761][WARN ][logstash.outputs.elasticsearch] You have enabled encryption but DISABLED certificate verification, >[2024-05-26T07:07:09,770][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[>[2024-05-26T07:07:09,867][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://so_elastic:xxxxx>[2024-05-26T07:07:09,876][INFO ][logstash.outputs.elasticsearch] Elasticsearch version determined (8.10.4) {:es_version=>8}
[2024-05-26T07:07:09,876][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the type event field won't be u>[2024-05-26T07:07:09,900][INFO ][logstash.outputs.elasticsearch] New Elasticsearch output {:class=>"LogStash::Outputs::ElasticSearch>[2024-05-26T07:07:09,901][WARN ][logstash.outputs.elasticsearch] You have enabled encryption but DISABLED certificate verification, >[2024-05-26T07:07:09,908][INFO ][logstash.outputs.elasticsearch] Elasticsearch pool URLs updated {:changes=>{:removed=>[], :added=>[>[2024-05-26T07:07:10,111][WARN ][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=>"https://so_elastic:xxxxx>[2024-05-26T07:07:10,144][INFO ][logstash.outputs.elasticsearch] Elasticsearch version determined (8.10.4) {:es_version=>8}
[2024-05-26T07:07:10,144][WARN ][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the type event field won't be u>[2024-05-26T07:07:10,190][INFO ][logstash.outputs.elasticsearch] Not eligible for data streams because ecs_compatibility is not enab>[2024-05-26T07:07:10,190][INFO ][logstash.outputs.elasticsearch] Data streams auto configuration (data_stream => auto or unset) re>[2024-05-26T07:07:10,202][INFO ][logstash.javapipeline ] Starting pipeline {:pipeline_id=>"search", "pipeline.workers"=>4, "pipel>[2024-05-26T07:07:10,223][INFO ][logstash.outputs.elasticsearch] Using a default mapping template {:es_version=>8, :ecs_compatibilit>[2024-05-26T07:07:11,202][INFO ][logstash.javapipeline ] Pipeline Java execution initialization time {"seconds"=>3.24}
[2024-05-26T07:07:11,596][INFO ][logstash.javapipeline ] Pipeline Java execution initialization time {"seconds"=>1.39}
[2024-05-26T07:07:11,719][INFO ][logstash.inputs.redis ] Registering Redis {:identity=>"redis://@hsa-so:9696/0 list:log>
Guidelines
Beta Was this translation helpful? Give feedback.
All reactions