Security Onion 2.4.170 issuse

[sandraimmaculate]

Version

2.4.170

Installation Method

Other (please provide detail below)

Description

upgrading

Installation Type

Standalone

Location

cloud

Hardware Specs

Exceeds minimum requirements

CPU

4vpcu

RAM

16gb

Storage for /

256gb

Storage for /nsm

249G

Network Traffic Collection

tap

Network Traffic Speeds

more than 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hello Team,

i have recently upgraded my security onion to 2.4.170 from 2.4.160 the terminal got terminated because of the network issues so the upgrade got terminated in the middle itself!.
once the network issues got resolved i have tried to execute the soup command again to complete the upgrade but it shows SO is running with the latest version.
but from that day load of security onion is high
IDK how to re-run the soup command
i think the load is not reducing because of this reason. Can you help me to re initiate the soup command. Or is there any other solutions!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Can you let me know what these show?

sudo docker images
sudo salt-call state.show_top

[sandraimmaculate]

and now the command:
sudo salt-call state.highstate give error

local:
    Data failed to compile:
----------
    The function "state.sls" is running as PID 2552084 and was started at 2025, Sep 05 13:05:19.236308 with jid 20250905130519236308

sudo salt-call state.highstate -l info

Summary for local
---------------
Succeeded: 1618 (changed=33)
Failed:       6
---------------
Total states run:     1624
Total run time:    950.658 s

[cm-ops]

Is the salt-master service running and okay? Looks like some timeouts.

Look in the /opt/so/log/salt/master for any other clues.

[sandraimmaculate]

tail -50f master
2025-09-08 13:34:37,214 [salt.master      :2520][INFO    ][2059] User root Published command x509.sign_remote_certificate with jid 20250908133437210673
2025-09-08 13:34:37,509 [salt.utils.job   :85  ][INFO    ][2060] Got return from security-onion_standalone for job 20250908133437210673
2025-09-08 13:34:39,201 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133439141586
2025-09-08 13:34:40,631 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133439765143
2025-09-08 13:34:41,936 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133441367362
2025-09-08 13:34:43,364 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133442649730
2025-09-08 13:34:44,658 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133443977483
2025-09-08 13:34:46,393 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133446313587
2025-09-08 13:34:47,696 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133447054369
2025-09-08 13:34:48,992 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133448302225
2025-09-08 13:34:50,750 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133449784762
2025-09-08 13:34:50,785 [salt.client.mixins:441 ][INFO    ][2043] Runner completed: 20250908133450664804
2025-09-08 13:34:52,392 [salt.client.mixins:441 ][INFO    ][2043] Runner completed: 20250908133451493155
2025-09-08 13:34:52,676 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133451698260
2025-09-08 13:34:54,481 [salt.client.mixins:441 ][INFO    ][2043] Runner completed: 20250908133453728410
2025-09-08 13:34:55,307 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133455240326
2025-09-08 13:34:56,474 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133455772355
2025-09-08 13:34:58,007 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133457083741
2025-09-08 13:34:59,404 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133458745484
2025-09-08 13:35:00,921 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133459988734
2025-09-08 13:35:03,763 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133503693103
2025-09-08 13:35:05,239 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133504512950
2025-09-08 13:35:06,389 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133505733809
2025-09-08 13:35:07,888 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133507209970
2025-09-08 13:35:09,187 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133508345516
2025-09-08 13:35:11,438 [salt.client.mixins:441 ][INFO    ][2069] Runner completed: 20250908133511359400
2025-09-08 13:35:12,570 [salt.client.mixins:441 ][INFO    ][2069] Runner completed: 20250908133511925408
2025-09-08 13:35:13,622 [salt.client.mixins:441 ][INFO    ][2069] Runner completed: 20250908133513024482
2025-09-08 13:35:15,315 [salt.client.mixins:441 ][INFO    ][2069] Runner completed: 20250908133514381384
2025-09-08 13:35:16,304 [salt.client.mixins:441 ][INFO    ][2069] Runner completed: 20250908133515739876
2025-09-08 13:35:18,326 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133518251437
2025-09-08 13:35:19,388 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133518826543
2025-09-08 13:35:20,797 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133519929662
2025-09-08 13:35:22,008 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133521502662
2025-09-08 13:35:23,107 [salt.client.mixins:441 ][INFO    ][2067] Runner completed: 20250908133522406035
2025-09-08 13:35:25,209 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133525146191
2025-09-08 13:35:26,344 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133525604912
2025-09-08 13:35:27,642 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133526999014
2025-09-08 13:35:28,902 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133528306235
2025-09-08 13:35:30,136 [salt.client.mixins:441 ][INFO    ][2059] Runner completed: 20250908133529394199
2025-09-08 13:35:32,597 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133532500442
2025-09-08 13:35:34,078 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133533303525
2025-09-08 13:35:35,226 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133534500424
2025-09-08 13:35:36,600 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133535949708
2025-09-08 13:35:37,905 [salt.client.mixins:441 ][INFO    ][2068] Runner completed: 20250908133537191285
2025-09-08 13:35:38,170 [salt.master      :2520][INFO    ][2069] User root Published command x509.sign_remote_certificate with jid 20250908133538168563
2025-09-08 13:35:38,425 [salt.utils.job   :85  ][INFO    ][2059] Got return from security-onion_standalone for job 20250908133538168563
2025-09-08 13:35:40,180 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133540084278
2025-09-08 13:35:41,268 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133540638148
2025-09-08 13:35:42,463 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133541810066
2025-09-08 13:35:43,954 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133543179211
2025-09-08 13:35:45,113 [salt.client.mixins:441 ][INFO    ][2060] Runner completed: 20250908133544475468

[sandraimmaculate]

Hello sir,
It is running in production and it consuming more vcpu the load is not reducing at all
Please help me to solve this!

[cm-ops]

What is using the most CPU? What does top command look like? Is your information above correct, 4 CPU?