forward node asking for re-installation of iso image after restart from SOC grid

[raphaeleid]

Version

2.4.40

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

cloud

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

500

Storage for /nsm

500

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I was trying to reboot a node after update from SOC grid dashboard. After rebooting it failed, and I entered on the node to check whats going on, it re-asked for installation of the ISO image.

What is causing this?

it is happening on the forward node

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

I was trying to reboot a node after update from SOC grid dashboard. After rebooting it failed, and I entered on the node to check whats going on, it re-asked for installation of the ISO image.

What was the exact message?

You specify above that installation method is Security Onion ISO image and location is cloud. Could you provide more details about how exactly you installed and which cloud provider you used?

[raphaeleid]

Hi Doug,

Hope all is good, we are hosting it on VMware, 3 different nodes:

• managersearch
• search
• forward

I reverted to the snapshot/backup i took in 1 june, now the search and forward node are ok on the grid (i still dont know why this happened in our environment) and now the managersearch node is showing pending on the grid, even though it asked for reboot, I rebooted it and now it is still pending, does it usually happen? im trying to troubleshoot it but still cant find nothing.

Like i reverted all the snapshots for the 3 nodes, the search and forward are OK on the grid (out of nowhere after showing failed) and now the managersearch is pending after reboot

Thank you for your help in advance

Best,

[dougburks]

now the managersearch node is showing pending on the grid, even though it asked for reboot, I rebooted it and now it is still pending, does it usually happen? im trying to troubleshoot it but still cant find nothing.

Please see the Known Issues section of the documentation:
https://docs.securityonion.net/en/2.4/release-notes.html#known-issues.