Configuration fails

[cole-1]

Version

2.4.130

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4vCPU

RAM

16GB

Storage for /

200GB

Storage for /nsm

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

After the installation of SO from ISO on my VM through Hyper-V conifuration runs automatically.
After selecting all of the options the setup ends with an error:

Here is the errors.log:

[INFO ] {'pid': 99219, 'retcode': 0, 'stdout': '\nSetting up so-case-logs policy...\n{"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-lifecycle-so-case-logs) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-lifecycle-so-case-logs) within 30s"},"status":503}\n\nSetting up so-common-logs policy...\n{"acknowledged":true}\n\nSetting up so-detection-logs policy...\n{"acknowledged":true}\n\nSetting up so-endgame-logs policy...\n{"acknowledged":true}\n\nSetting up so-idh-logs policy...\n{"acknowledged":true}\n\nSetting up so-import-logs policy...\n{"acknowledged":true}\n\nSetting up so-ip-mappings-logs policy...\n{"acknowledged":true}\n\nSetting up so-items-logs policy...\n{"acknowledged":true}\n\nSetting up so-kismet-logs policy...\n{"acknowledged":true}\n\nSetting up so-kratos-logs policy...\n{"acknowledged":true}\n\nSetting up so-hydra-logs policy...\n{"acknowledged":true}\n\nSetting up so-lists-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-detections.alerts-so policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.apm_server-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.auditbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.cloudbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.endpoint_security-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.filebeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.fleet_server-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.heartbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.metricbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.osquerybeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-elastic_agent.packetbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.actions-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.action.responses-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.alerts-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.diagnostic.collection-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.api-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.file-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.library-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.network-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.process-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.registry-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.events.security-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-endpoint.heartbeat-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-http_endpoint.generic-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-httpjson.generic-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-osquery-manager.action.responses-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-osquery-manager.result-logs policy...\n{"acknowledged":true}\n\nSetting up so-soc-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-soc-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-system.application-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-system.auth-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-system.security-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-system.syslog-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-system.system-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-windows.forwarded-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-windows.powershell-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-windows.powershell_operational-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-windows.sysmon_operational-logs policy...\n{"acknowledged":true}\n\nSetting up so-logs-winlog.winlog-logs policy...\n{"acknowledged":true}\n\nSetting up so-logstash-logs policy...\n{"acknowledged":true}\n\nSetting up so-metrics-endpoint.metadata-logs policy...\n{"acknowledged":true}\n\nSetting up so-metrics-endpoint.metrics-logs policy...\n{"acknowledged":true}\n\nSetting up so-metrics-endpoint.policy-logs policy...\n{"acknowledged":true}\n\nSetting up so-redis-logs policy...\n{"acknowledged":true}\n\nSetting up so-strelka-logs policy...\n{"acknowledged":true}\n\nSetting up so-suricata-logs policy...\n{"acknowledged":true}\n\nSetting up so-suricata.alerts-logs policy...\n{"acknowledged":true}\n\nSetting up so-syslog-logs policy...\n{"acknowledged":true}\n\nSetting up so-zeek-logs policy...\n{"acknowledged":true}', 'stderr': ''} {"error":{"root_cause":[{"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-lifecycle-so-case-logs) within 30s"}],"type":"process_cluster_event_timeout_exception","reason":"failed to process cluster event (put-lifecycle-so-case-logs) within 30s"},"status":503}

I'm a bit out of my depth here, any help is much appreciated.

If there's more info needed I will provide whatever I can.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[dougburks]

RAM
16GB

Per https://docs.securityonion.net/en/2.4/hardware.html#standalone-deployments, do you have swap space enabled?

Do you have more RAM available in your host that you can allocate to the VM?

[cole-1]

I have upgraded the VM to 24GB RAM, can I now somehow restart the configuration or do i need to start the installation from scratch?

[dougburks]

For best results, I'd recommend a fresh installation.

[cole-1]

I have begun the reinstall, it's going to take a while, since it usually hangs on the post-install reboot ("Pane is dead" line), I'll let you know as soon as it finishes.
Thank you for the help!