so-elasticsearch-ilm

[argwfm]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

8

RAM

32

Storage for /

256

Storage for /nsm

512

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Running into an issue w/ the SO ILM commands: so-elasticsearch-ilm-restart and so-elasticsearch-ilm-start are not working on my SOv2.4.150 deployment. -restart successfully issues the ILM stop command, but fails to re-start ILM. Having to manually start ILM by issuing so-elasticsearch-query _ilm/start -X POST

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[argwfm]

Providing a bit more data on this possible bug... ILM is stopped and it seems to drop you in a fresh shell session (almost as if it's calling su or chroot). You then have to manually exit to get ILM to re-start.

[root@manager /]# so-elasticsearch-ilm-restart
Stopping ILM...
{"acknowledged":true}[root@manager /]# exit
exit
Starting ILM...
{"acknowledged":true}[root@manager /]#

[dougburks]

Looks like so-elasticsearch-ilm-start is missing the shebang at the beginning of the file and so it's just spawning a whole new bash session. I've created issue #14688 to fix this.

[argwfm]

TY, Doug!