SEARCH NODE DOES'NT SHOW UP ANYMORE ON GRID INTERFACE.

[claudy12]

I HAVE JUST UPGRADE FROM SECURITY 110 T0 130. AFTER A WHILE, I NOTICED THAT MY SEARCH NODE WAS NO MORE ON GRID INTERFACE. I NEED TO KNOW WHAT HAPPENED BEFORE UPDATION OUR PRODUCTION VERSION TO 130.
PLEASE HELP

[reyesj2]

A reminder to read over #1720
Specifically

Avoid yelling
Avoid typing in ALL CAPS as this looks like YELLING!

and

Provide sufficient technical info
In order to be as effective and efficient as possible, please consider the following when posing your question/problem to the group:
http://www.chiark.greenend.org.uk/~sgtatham/bugs.html

Please include the following details where you can:

• Security Onion version as seen in the lower left corner of SOC and in /etc/soversion. For example: 2.4.10
• Is this a cloud deployment or on-prem? If on-prem, do you have Internet access or this an airgap installation?
• Did you install from our Security Onion ISO image or did you perform a network installation?
• If network installation, what distro and version did you install on?
• How many nodes do you have?
• What are the hardware specs of each of those nodes?
• How are each of those nodes configured? (ex. manager with 2 search nodes and 3 forward nodes)
• Are you experiencing issues monitoring network traffic? If so, are you sniffing from a tap or span port and what is the traffic volume?
• Does so-status show all services running?
• Do you get any failures when you run sudo salt-call state.highstate?
• Does the SOC Grid page show any failures?
• Explain your issue. For example: Installation fails when I select this series of options...
• Provide applicable logs. If you are having problems right after setup, provide /root/sosetup.log. If you are having problems during soup, provide /root/soup.log. If you are having problems with a specific component, provide that component's logs from /opt/so/log/.

[cm-ops]

What do these commands show?

sudo salt \* test.ping
sudo salt \* system.get_system_date_time
sudo salt \* test.version

Also, no need to post all in capital letters. It's best to avoid that as it looks like you are yelling.

[claudy12]

Sorry for posting in capital letter... In our production, we are still using 110 version and I wanted to move to 130 then I got that surprising situation. I am using ISO security onion image to install my deployment. Now I re-installed version 110 to move to version 140.....If I got the same issue, I will those commands. Thank you so much for your help.

…

On Fri, Apr 4, 2025 at 11:31 AM Chris Morgret ***@***.***> wrote: What do these commands show? sudo salt \* test.ping sudo salt \* system.get_system_date_time sudo salt \* test.version Also, no need to post all in capital letters. It's best to avoid that as it looks like you are yelling. — Reply to this email directly, view it on GitHub <#14504 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AXTBJUNYOPUS4KPQBOY5MXD2X2QW3AVCNFSM6AAAAAB2M2B3ESVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENZSG43TINY> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/14504/comments/12727747 @github.com>