No Alerts After Upgrading Security Onion to Version 2.4.141

[Chizan-Dolrocks]

Summary

After upgrading Security Onion to Version 2.4.141, no alerts are being generated or displayed. Upon investigating the issue, it was discovered that the Logstash service is encountering memory-related errors.

---

Problem Details

Issue Observed

No alerts are visible after upgrading Security Onion to the latest version. This issue was observed immediately after the upgrade.

Troubleshooting Steps

1. Verified that all services are running correctly using the command:

   sudo so-status

2. Checked the Logstash log file using:

   tail -f /opt/so/log/logstash/logstash.log

3. Identified the following error message in the log file:

   java.lang.OutOfMemoryError: Cannot reserve 16777216 bytes of direct buffer memory (allocated: 518448622, limit: 524288000)
   

   • This error indicates that Logstash is attempting to allocate more direct buffer memory than allowed.

---

Question

Has anyone encountered this issue before after upgrading Security Onion to version 2.4.141? What could be causing Logstash to run out of memory, and how can I resolve it?

Any guidance or suggestions would be greatly appreciated.

[cm-ops]

What is your Logstash heap setting? In SOC > Administration > Configuration > logstash > config > lsheap

[Chizan-Dolrocks]

the value of Logstash heap setting is 500m

[cm-ops]

Depending on how much RAM you have, I would bump that to 2048m and restart Logstash. If you are running at minimum specs, then maybe 1024m and restart.