Suricata Missing - "Rendering SLS 'base:suricata.config' failed"

[rfuller318]

Version

2.4.90

Installation Method

Other (please provide detail below)

Description

upgrading

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

32

RAM

128

Storage for /

32 TB

Storage for /nsm

8 GB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

I upgraded to 2.4.9 two days ago. Things were going fine until Suricata entered a Rule Mismatch state earlier today. I checked the integrity logs, but there was never an integrity report generated, only a show of integrity discrepancies. After a couple of reboots, so-suricata entered the Missing status.

Both so-checkin and so-suricata-restart give the following error:

local:
Data failed to compile:

Rendering SLS 'base:suricata.config' failed: Jinja variable list object has no element 0; line 119

---

[...]
suriconfig:
file.managed:
- name: /opt/so/conf/suricata/suricata.yaml
- source: salt://suricata/files/suricata.yaml.jinja
- context:
suricata_config: {{ SURICATAMERGED.config }} <======================
- user: 940
- group: 940
- template: jinja

surithresholding:
[...]

Any thoughts on this one?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[rfuller318]

I figured out the problem.

There was a blank array value in /opt/so/saltstack/local/pillar/suricata/soc_suricata.sls from a Suricata variable I was attempting to test out. Clearing it from soc_suricata.sls and saving it allowed so-suricata-start to start the Suricata container, and allowed a successful so-checkin after running twice.