pcap import not seen in the console

[RailsGuy]

Version

2.4.140

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Import

Location

cloud

Hardware Specs

Meets minimum requirements

CPU

4

RAM

6GB

Storage for /

100GB

Storage for /nsm

56GB

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

Hi there, I'm new to SO and have an "import" install of Version: 2.4.141. I have attempted to import pcap files but not seeing any results in the console. Have I done something wrong or could there be a problem with my install?

"sudo salt-call state.highstate" shows 4 failures from so-elastic-fleet and so-elastic-agent see below. Not sure if these are relevant?

# Captured the pcap with
sudo tcpdump -i ens224 -w /tmp/tcpd_test.pcap 
 
# Import on SO

 sudo so-import-pcap tcpd_test.pcap
 Processing Import: /home/{MYSO}/tcpd_test.pcap
 - verifying file
 - assigning unique identifier to import: b2481ba090bc7951689fa6b4f2821cb5
 - analyzing traffic with Suricata
 - analyzing traffic with Zeek
 - found PCAP data spanning dates 2025-04-21 through 2025-04-21

 Import complete!

 Use the following hyperlink to view the imported data. Triple-click to quickly highlight the entire hyperlink and then copy it into a browser:
 https://{MYSOIP}/#/dashboards?q=import.id:b2481ba090bc7951689fa6b4f2821cb5%20%7C%20groupby%20event.module*%20%7C%20groupby%20-sankey%20event.module*%20event.dataset%20%7C%20groupby%20event.dataset%20%7C%20groupby%20source.ip%20%7C%20groupby%20destination.ip%20%7C%20groupby%20destination.port%20%7C%20groupby%20network.protocol%20%7C%20groupby%20rule.name%20rule.category%20event.severity_label%20%7C%20groupby%20dns.query.name%20%7C%20groupby%20file.mime_type%20%7C%20groupby%20http.virtual_host%20http.uri%20%7C%20groupby%20notice.note%20notice.message%20notice.sub_message%20%7C%20groupby%20ssl.server_name%20%7C%20groupby%20source_geo.organization_name%20source.geo.country_name%20%7C%20groupby%20destination_geo.organization_name%20destination.geo.country_name&t=2025%2F04%2F21%2000%3A00%3A00%20AM%20-%202025%2F04%2F22%2000%3A00%3A00%20AM&z=UTC

 or, manually set the Time Range to be (in UTC):
 From: 2025-04-21    To: 2025-04-22

 Note: It can take 30 seconds or more for events to appear in Security Onion Console.

# import log
cat  /opt/so/log/suricata/import/b2481ba090bc7951689fa6b4f2821cb5/console.log 
i: suricata: This is Suricata version 7.0.9 RELEASE running in USER mode
E: logopenfile: Error opening file: "./stats.log": Permission denied
W: runmodes: output module "stats": setup failed
W: counters: stats are enabled but no loggers are active
i: threads: Threads created -> W: 1 FM: 1 FR: 1   Engine started.
i: suricata: Signal Received.  Stopping engine.
i: pcap: read 1 file, 34798 packets, 24683768 bytes


# import files
ls -l  /nsm/import/b2481ba090bc7951689fa6b4f2821cb5/suricata/
total 64
-rw-r--r--. 1 suricata suricata 63476 Apr 21 12:19 eve-2025-04-21-12:19.json
-rwxr-xr-x. 1 root     root         0 Apr 21 12:19 suripcap

 ls -l  /nsm/import/b2481ba090bc7951689fa6b4f2821cb5/zeek/logs/
total 2068
-rw-r--r--. 1 root root     109 Apr 21 12:19 capture_loss.log
-rw-r--r--. 1 root root  218596 Apr 21 12:19 conn.log
-rw-r--r--. 1 root root     197 Apr 21 12:19 console.log
-rw-r--r--. 1 root root   84963 Apr 21 12:19 dns.log
-rw-r--r--. 1 root root   13573 Apr 21 12:19 ecat_arp_info.log
-rw-r--r--. 1 root root    3761 Apr 21 12:19 files.log
-rw-r--r--. 1 root root    3634 Apr 21 12:19 http.log
-rw-r--r--. 1 root root     339 Apr 21 12:19 known_certs.log
-rw-r--r--. 1 root root     804 Apr 21 12:19 known_hosts.log
-rw-r--r--. 1 root root    2583 Apr 21 12:19 known_services.log
-rw-r--r--. 1 root root   48032 Apr 21 12:19 loaded_scripts.log
-rw-r--r--. 1 root root 1622351 Apr 21 12:19 mysql.log
-rw-r--r--. 1 root root    1207 Apr 21 12:19 notice.log
-rw-r--r--. 1 root root   24535 Apr 21 12:19 ntp.log
-rw-r--r--. 1 root root      90 Apr 21 12:19 packet_filter.log
-rw-r--r--. 1 root root     249 Apr 21 12:19 reporter.log
-rw-r--r--. 1 root root     598 Apr 21 12:19 software.log
-rw-r--r--. 1 root root   14086 Apr 21 12:19 ssh.log
-rw-r--r--. 1 root root   25936 Apr 21 12:19 ssl.log
-rw-r--r--. 1 root root    1348 Apr 21 12:19 x509.log


# status
 sudo so-status

                        Security Onion Status                        
                         Container │ Status  │               Details 
───────────────────────────────────┼─────────┼───────────────────────
                 so-dockerregistry │ running │           Up 17 hours 
                  so-elastic-fleet │ running │           Up 17 hours 
 so-elastic-fleet-package-registry │ running │ Up 17 hours (healthy) 
                  so-elasticsearch │ running │           Up 17 hours 
                       so-idstools │ running │           Up 17 hours 
                       so-influxdb │ running │ Up 17 hours (healthy) 
                         so-kibana │ running │           Up 17 hours 
                         so-kratos │ running │           Up 17 hours 
                          so-nginx │ running │ Up 17 hours (healthy) 
                      so-sensoroni │ running │           Up 17 hours 
                            so-soc │ running │           Up 17 hours 
                       so-telegraf │ running │           Up 17 hours 

 ✔ This onion is ready to make your adversaries cry!

Failures from sudo salt-call state.highstate

----------
          ID: so-elastic-fleet-auto-configure-server-urls
    Function: cmd.run
        Name: /usr/sbin/so-elastic-fleet-urls-update
      Result: False
     Comment: Attempt 1: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-urls-update" run"
              Attempt 2: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-urls-update" run"
              Attempt 3: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-urls-update" run"
              Command "/usr/sbin/so-elastic-fleet-urls-update" run
     Started: 13:40:40.690782
    Duration: 90203.037 ms
     Changes:   
----------
          ID: so-elastic-fleet-auto-configure-elasticsearch-urls
    Function: cmd.run
        Name: /usr/sbin/so-elastic-fleet-es-url-update
      Result: False
     Comment: Attempt 1: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-es-url-update" run"
              Attempt 2: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-es-url-update" run"
              Attempt 3: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-fleet-es-url-update" run"
              Command "/usr/sbin/so-elastic-fleet-es-url-update" run
     Started: 13:42:10.976409
    Duration: 90154.753 ms
     Changes:   
----------
          ID: so-elastic-agent-grid-upgrade
    Function: cmd.run
        Name: /usr/sbin/so-elastic-agent-grid-upgrade
      Result: False
     Comment: Attempt 1: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 2: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 3: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 4: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 5: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 6: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 7: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 8: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 9: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 10: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Attempt 11: Returned a result of "False", with the following comment: "Command "/usr/sbin/so-elastic-agent-grid-upgrade" run"
              Command "/usr/sbin/so-elastic-agent-grid-upgrade" run
     Started: 13:43:42.561548
    Duration: 55982.68 ms
     Changes:   
----------
          ID: so-elastic-fleet-integration-upgrade
    Function: cmd.run
        Name: /usr/sbin/so-elastic-fleet-integration-upgrade
      Result: False
     Comment: Command "/usr/sbin/so-elastic-fleet-integration-upgrade" run
     Started: 13:44:38.592852
    Duration: 29.894 ms
     Changes:   

---------------

Summary for local
--------------
Succeeded: 613 (changed=33)
Failed:      4
--------------
Total states run:     617
Total run time:   307.671 s

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[RailsGuy]

I've increased hardware spec rebooted and highstate no longer reports any failures
I also imported a few pcap samples from malware-traffic-analysis.net but still nothing in the console.

sudo salt-call state.highstate
...
Summary for local
---------------
Succeeded: 1358 (changed=33)
Failed:       0
---------------
Total states run:     1358
Total run time:    130.890 s

[reyesj2]

Try running and share output

sudo elastic-agent status

[RailsGuy]

I re-installed and everything is working now thank you. I'm not sure what the problem was.