Install failing and can’t access /root/errors.log to see why

[noonenobodyknows]

Version

2.4.20

Installation Method

Security Onion ISO image

Description

installation

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

6

RAM

16 gb

Storage for /

2 tb

Storage for /nsm

2 tb

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi.  I have been trying to install security onion and have been having issues with the install failing around the middle of the install.  At the end, it tells me the “install failed and to look in the logs at /root/errors.log.  But when I try to go there, I am denied access.  Then when I try to switch user to root and use the user password that I created during setup, it doesn’t work.  Neither does any other default password I could think of like root, password, security, onion, securityonion.  I’ve also looked around online to see if anyone else has experienced this or may know what the password would be but haven’t found anything.  Any help would be appreciated.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Use sudo su - then use the password you set up.

[noonenobodyknows]

Unfortunately, this did not work either

[cm-ops]

What is the user you set up when you installed? What password did you set for that user?

[noonenobodyknows]

I tried that over and over again and it didn’t work. I tried installing it over again even using an easy password that way i would know for sure that I was putting in the password and it still didn’t work. Anyway, I tried again on a different computer and that time I was able to access the folder using sudo su. Not sure what would cause the issue on the other computer. Especially since it exceeded the minimum resources even more so. Anyway, finally got the install to go all the way through. But none of the services are up when I go to so-status. But I guess, that’s another conversation. I guess I would be curious to know why sudo su was not allowing me to see the errors on the other computer when it was failing. It only worked after the install actually finished and of course then the file was empty so there was nothing to see by then.

…

On Fri, Jun 20, 2025 at 9:21 AM Chris Morgret ***@***.***> wrote: What is the user you set up when you installed? What password did you set for that user? — Reply to this email directly, view it on GitHub <#14740 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BTQOKEF2U5SLSFHW46PCCWD3EQDG7AVCNFSM6AAAAAB7GEO3EGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGNJTGA3TKMY> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/14740/comments/13530753 @github.com>

[cm-ops]

When you run sudo so-status what does it return?

[noonenobodyknows]

It just states this: system appears to be starting. no highstate has completed since the system was restarted.

…

On Mon, Jun 23, 2025 at 10:29 AM Chris Morgret ***@***.***> wrote: When you run sudo so-status what does it return? — Reply to this email directly, view it on GitHub <#14740 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BTQOKECOJX25NHK2DIALJZD3FAFLDAVCNFSM6AAAAAB7GEO3EGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGNJVGE4TSMY> . You are receiving this because you authored the thread.Message ID: <Security-Onion-Solutions/securityonion/repo-discussions/14740/comments/13551993 @github.com>

[noonenobodyknows]

Hey, thanks a lot for your help. It is working now. Virtualization was turned off in the bios so that’s probably why the services weren’t starting. Thanks

…

On Tue, Jun 24, 2025 at 10:25 PM Noone ***@***.***> wrote: It just states this: system appears to be starting. no highstate has completed since the system was restarted. On Mon, Jun 23, 2025 at 10:29 AM Chris Morgret ***@***.***> wrote: > When you run sudo so-status what does it return? > > — > Reply to this email directly, view it on GitHub > <#14740 (reply in thread)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/BTQOKECOJX25NHK2DIALJZD3FAFLDAVCNFSM6AAAAAB7GEO3EGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTGNJVGE4TSMY> > . > You are receiving this because you authored the thread.Message ID: > <Security-Onion-Solutions/securityonion/repo-discussions/14740/comments/13551993 > @github.com> >