System freezes after serveral hours

[bigfoot50]

Version

2.4.111

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

16

Storage for /

250GB

Storage for /nsm

1TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi,
I use a small security Onion System at Home.

16GB ECC Ram
250GB root single SSD
1TB single SSD for nsm
4 CPU cores intel xeon
6 Elastic agents on small linux systems

Everything works well, but at morning after around 14h the system are not reachable (web, ssh). The drive LED is permanent on (like heavy write or read actions on disc). After restart everythings work well the next 14h.

System are installed bare metall and up to date.

System is only 2 days old out of the box, no customation, no custom rules, no custom integrations.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

This is most likely a RAM issue. From https://docs.securityonion.net/en/2.4/hardware.html#standalone-deployments (emphasis added):

In a standalone deployment, the manager components and the sensor components all run on a single box so your hardware requirements will reflect that. You’ll need at minimum 16GB RAM, 4 CPU cores, and 200GB storage. At the bare minimum of 16GB RAM, you will need swap space to avoid issues. We recommend a minimum of 24GB of RAM if you plan on monitoring even a small amount of network traffic. More network traffic means higher hardware requirements.

If you are able to increase RAM, then that would be the best option.

If you are unable to increase RAM, you have a few options:

• add swap space if you don't already have any
• switch from Zeek to Suricata for metadata in order to save some RAM:
  https://docs.securityonion.net/en/2.4/suricata.html#metadata
• reinstall in Eval mode as this has lower requirements than Standalone