License Exceeded after SOUP

[jdonovan-itcnp]

Version

2.4.160

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Meets minimum requirements

CPU

4

RAM

24

Storage for /

100

Storage for /nsm

215

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

We are seeing License: Exceeded after running SOUP to latest version.

We do not have a Pro license, so it is unclear why the license is having an issue. Was there a change in licensing that we need to account for in one of the recent releases?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[err0r20]

jdonovan-itcnp,

Are you trying to utilize certain Pro features without a license? Like STIG, LUKS, etc. If not, try restarting SOC (sudo so-soc-restart) or running a so-checkin, and see if that clears anything up. I suggest a hard refresh on your browser (Ctrl+Shift+r), as well, or see if it persists in an incognito/private window.

[jdonovan-itcnp]

No, we have no enabled any new features. The only thing that has changed is that we upgraded using SOUP. Restarts don't seem to be making any difference.

[dougburks]

@jdonovan-itcnp

Please run the following command:

sudo grep exceeded /opt/so/log/soc/sensoroni-server.log

Then reply with the output.

[dougburks]

Are you using FIPS?
https://docs.securityonion.net/en/2.4/fips.html

[jdonovan-itcnp]

@dougburks No, we didn't enable the FIPS feature in SecurityOnion.

I believe we did manually configure FIPS mode on the operating system only. Would that cause this?

[dougburks]

Yes, when enabling the FIPS feature in Security Onion it configures FIPS mode on the operating system.

[jdonovan-itcnp]

@dougburks Acknowledged. So, we can therefore conclude that we cannot enable FIPS on the OS without a Pro License, correct?

[dougburks]

Yes, that's correct.