so-status shows so-dockerregistry running, all others missing after installation

[JDMcCADD-1]

I'm attempting to install Security Onion Standalone from ISO. Hardware requirements met. Initial installation proceeds without error, but after three attempts each fails with "Install had a problem". so-status shows only the first container running, all others missing.
I don't know if this is relevant, but hardware has only one hardwired LAN port, so I'm using USB 3.0 Gb ethernet adapter as 2nd LAN. I've attempted installation using both integrated LAN and USB Gb LAN adapter as management, but setup fails in both cases.

Hardware
Core i7-8700T @ 2.4GHz
6 cores
32GB
2TB SSD
Security Onion 2.4.111 installed from ISO
On premises with internet access
salt-call state.highstate errors show 'Data failed to compile'

so-setup.log, errors.log below
sosetup.log
errors.log

so-checkin, so-status, and salt-call output follow (typescript files, but with .txt extension since .ts not listed in default upload filetypes)
so-checkin.txt
so-status.txt
salt-call.txt

[cm-ops]

Looking at sosetup, it appears their is an issue with docker registry on the standalone. Do you see any images if you run sudo docker images? What happens if you run sudo so-docker-refresh?

[JDMcCADD-1]

I ran both of these commands and it shows some improvement. so-status now shows only 7 components missing. I wish I had captured the output of the first run of the so-docker-refresh pass. There was a lot happening there. A lot of pushing, pulling, updating I think. I captured the output of a second pass which looks very different - more or less stable. Most are 'Layer already exists'. I'll attach all. I'm curious whether successive passes of so-docker-refresh may help?
Prior to seeing your post I had considered reinstalling with 'Secure Boot' disabled in BIOS. It's currently enabled. The initial install ran successfully, but I did see numerous errors related to invalid certificates in one of the logs. Not sure if Secure Boot would have any influence over that. This system (Lenovo ThinkCentre M920q) has a TPM2.0 chip if that makes any difference.

docker_images.txt
so-docker-refresh.txt
so-checkin_20250214.txt
so-status_20250214.txt

[JDMcCADD-1]

After a couple more iterations of sudo docker images, so-docker-refresh, and so-checkin, so-status now shows only 4 containers missing. Those four are so-elastalert, so-elasticsearch, so-logstash, and so-nginx. However, those 4 fail to install regardless of having more iterations of the same commands. Listing the contents of /opt/so/log folders for the respective containers shows empty folders for all but so-elasticsearch, which contains a compressed log generated at 00:00 for each day the container has been up and running.

Any ideas how to install and activate the four missing containers?

so-status_20250215-1424.txt

[JDMcCADD-1]

The so-status I uploaded in my last post was about an hour before this one and showed all but one container missing. This one almost an hour later shows only 7 missing.

so-status_20250214-1746.txt

[dougburks]

@JDMcCADD-1 Here's what I would recommend:

• download the new 2.4.120 ISO image (see https://blog.securityonion.net/2025/02/security-onion-24120-now-available.html)
• verify the ISO image as shown at https://securityonion.com/download
• install the ISO image and choose the Airgap option (https://docs.securityonion.net/en/2.4/airgap.html) as this will install everything directly from the ISO image and rule out any network issues
• if you continue to have issues and think it may be related to Secure Boot, you should be able to turn that off and try again

[JDMcCADD-1]

Thank you Doug! That worked. I reinstalled last night using the 2.4.120 ISO image in Airgap mode. I was a bit dismayed when at the end of the installation I still received the error dialog "Install had a problem". I let it sit for 24 hours though and checked so-status just now - all running! I'm also able to log onto it from the IP designated for remote access during the install. Happy to be able to finally start exploring it. I'm curious though - is there a way to reconfigure it from airgap back to a standard install with internet access, or should I just leave it as airgap and update it manually?

[dougburks]

In theory, it is possible to go into the configuration and change that airgap setting. However, we can't make any guarantees that it will work as desired. You can just leave it in airgap mode and update via ISO image when they are released:
https://docs.securityonion.net/en/2.4/soup.html#airgap

[JDMcCADD-1]

I'm curious - at the end of the sosetup.log I see:
WARNING: Errors detected during setup.
--------- ERRORS ---------
Error: Connection activation failed: Unknown error

On lines 188-189 I see:
Error: Connection activation failed: Unknown error
Hint: use 'journalctl -xe NM_CONNECTION=80f12015-3f03-4606-9883-734ffd38d522 + NM_DEVICE=enp0s20f0u3' to get more details.

Could this mean my monitor/sensor NIC is not functioning?

When I execute the journalctl cmd specified the results show a repeated series of errors related to the same interface (output attached). The NIC is a Vantec USB 3.0 Gigabit Ehternet adapter. Is a special procedure required to utilize a USB ethernet adapter in Security Onion?

Also, although the so-status shows all containers running and 'up 2 days', only four are listed as '(healthy)' Is that any concern?

20250307_jouurnalctl-output.txt
20250307_so-status.txt

[JDMcCADD-1]

sosetup.log

[chisomobanja]

I have also just experienced this and it's left me baffled. Let me attempt to use the solutions you have been using. However, my security onion has been active for about two weeks and only gave this error this morning.

[dougburks]

@chisomobanja If you need help, please start a new discussion rather than replying to somebody else's discussion. Thanks!