Installation Failure: /so-functions Input/Output Errors & Read-Only Filesystem on Fresh Install (2.4.141)

[BandsTheBuilder]

Describe the issue:
I'm encountering repeated installation failures when trying to install Security Onion version 2.4.141 using the official ISO image. After successful boot and seemingly normal setup progression, the installation ultimately fails with multiple errors related to /so-functions, such as:

./so-functions: line 15: date: command not found
./so-functions: line 16: tee: command not found
/bin/sleep: Input/output error
/root/sosetup.log: Input/output error

The system also enters a read-only filesystem state, making further setup or recovery attempts impossible.

What I've tried:

• Verified the ISO file using SHA256: D0426D8E55E01A0FBA15AFE0BB7887CCB724C07FE82DA706CD1592E6001CD12B
• Successfully validated the ISO GPG signature
• Performed clean installs multiple times on VMware Workstation (Windows host)
• Ensured both network adapters are set to NAT for connectivity
• Network connectivity is functional (can ping external IPs and resolve DNS after setup)
• Tried both static and DHCP network configurations
• System fails at same point every time after package install and setup begins

Environment:

• Security Onion Version: 2.4.141 (ISO)
• VMware Workstation 17 Pro (latest)
• Host OS: Windows 11 Pro
• Guest VM: 4 CPUs, 16GB RAM, 225GB NVMe disk
• Verified internet access during install
• Used recommended virtual hardware specs and settings

Expected behavior:
Security Onion setup should complete and allow the system to boot into the configured interface (standalone mode) without file system corruption or missing critical commands.

Actual behavior:
Install crashes during final steps with filesystem errors and /so-functions command failures, making the installation unusable.

Screenshots:
(Attached screenshots show input/output errors and command not found issues)

Request:
Could someone from the team confirm if this is a known issue with the ISO or VMware compatibility? Is there a workaround, or should I use the OVA file instead?

Thank you!

[reyesj2]

If you are installing from the Security Onion ISO, once that installation completes are you seeing a message "Press enter to reboot"? As shown here https://docs.securityonion.net/en/2.4/_images/03_initial_install_finished.png

Can you share the output of running

lsblk

Can you manually run a command like

date

or do you see errors with that as well? This looks like an issue with the filesystem

[reyesj2]

Try looking through dmesg for errors relating to I/O or other issues related to the device /dev/nvme0n1

If you aren't seeing anything try creating a file in one of those directories like
touch /nsm/testfile then look at dmesg again for errors. You might be having issues with that specific drive. Do you have any others available you can work with?

[BandsTheBuilder]

No just this one I've tried deleting the ISO completely and reinstalling it and there's always something that goes wrong except the very first time when it actually worked but I forgot the password I used and had to reinstall it and that's when everything went wrong.

[reyesj2]

Are you using a USB formatted as an install drive or are you mounting the ISO directly and imaging the VM that way? What software are you using to create the bootable USB?

Have you checked dmesg for errors related to the /dev/nvme0n1 drive?

[BandsTheBuilder]

I got it fixed. It was the Salt packages that were missing and Docker Container Failures

Issue: After installation, essential Docker containers failed to start, rendering the Security Onion Console (SOC) inaccessible.

Diagnosis: Interrupted installation processes and unmet dependencies within the Docker environment caused container startup failures.

Resolution:
• Reinitialized Docker Containers:
• Executed the soup utility to update Security Onion components.
• Reinstalled any failed Docker containers using the appropriate Security Onion commands.

[BandsTheBuilder]

But I'm up and running now and thank you your assistance Reyes I greatly appreciate it. 😊