Consider to update new-disk documentation.

[Carlos-mb]

I moved the nsm directory to a new disk, which required steps not documented in "Method 2" of the documentation. I encountered several issues while following the manual:

• After running sudo service docker stop, the system suggested I also run systemctl stop docker.socket.
• Before adding the new file system mount for /nsm in /etc/fstab (as instructed by "# add your new file system to mount to /nsm in /etc/fstab"), shouldn't I remove the existing /nsm mount? However, if I do so, won't I lose access to the current /nsm content?
• I couldn't execute mv /nsm /nsm.old because the directory was busy, likely because it was mounted. I suspect it's on an LVM, which would prevent unmounting and moving the folder directly. Should I copy the files to the new location instead? Or move the contents of the current /nsm subdirectories to the new /nsm location, rather than moving the entire /nsm directory?
• Before running sudo mount -a, it's essential to run systemctl daemon-reload to reload the modified /etc/fstab file.

Here's what I did:

1. sudo systemctl disable salt-minion
2. reboot
3. sudo service docker stop
4. systemctl stop docker.socket
5. sudo lsof /nsm
6. Create and format partition in ext4
7. mkdir /nsm.new
8. Add partition to /etc/fstab: /dev/sdb1 /nsm.new ext4 defaults 0 0
9. systemctl daemon-reload
10. mount -a
11. cd /nsm
12. mv * /nsm.new/
13. umount nsm (I have to sudo lsof /nsm and kill some proccesses)
14. umount nsm.new
15. Edit /etc/fstab
16. remove /nsm mount
17. rename /nsm.new mount to /nsm
18. systemctl daemon-reload
19. mount -a
20. sudo systemctl enable salt-minion
21. reboot

According to so-status, It appears to work.. but.. I get a error 500 when trying to access web interface alerts, dashboard, etc...

The following is what ultimately resolved the issue, though the reason remains unclear.

• I reset my user password (to the same password) and rebooted.
• The system then failed to boot, reporting an inability to mount /nsm and a locked root user.
• I was able to boot choosing a previous kernel during the boot process.
• Afterward, booting with the latest kernel succeeded, and everything is now functioning correctly.

[dougburks]

I've updated the documentation:
https://docs.securityonion.net/en/2.4/new-disk.html

[Carlos-mb]

Thank you.

I agree with the new approach. My solution was the solution of a newbie

Regards