New to Security Onion - Installation fails.

[slee4774]

Version

2.4.70

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Eval

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

2

RAM

8

Storage for /

200

Storage for /nsm

n/a

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

more than 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I get an install had a problem. Please see /root/sosetup.log for details. Pretty new to this/linux so I have no clue where to go to check out the log. Any help would be great.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

You can output the entire file like this:

sudo cat /root/sosetup.log

You can review it one page at a time like this:

sudo more /root/sosetup.log

You can search for errors like this:

sudo grep "ERROR" /root/sosetup.log

[slee4774]

Thanks for the help. Here's what the error log tells me:

SO errors.docx

[dougburks]

From #1720:

If you attach files, please make sure they are plain text format. No Word docs or PDFs please.

[slee4774]

"The Salt master has cached the public key for this node, this salt minion will wait for 10 seconds before attempting to reauthenticate."

"unable to cache file 'salt://elasticfleet/files/so_agent-installers/so-elastic-agent_linux_amd64' from saltenv 'base'

[dougburks]

Is this a VM or bare metal installation?

If VM, are there other VMs that are competing for resources?

What type of underlying storage? (SSD, NVME, rotational media)

You state in your original post that you have 2 CPUs. Have you tried increasing to 4 to meet the minimum requirements?
https://docs.securityonion.net/en/2.4/hardware.html#minimum-specs

You state in your original post that you have 8GB RAM. Have you tried increasing RAM beyond just the bare minimum?

You state in your original post that your network traffic is more than 10Gbps. Are you actually trying to build a sensor to monitor that much traffic? If so, you will need much more than the minimum requirements. For more information, please see:
https://docs.securityonion.net/en/2.4/hardware.html#sensor-hardware-considerations