After fresh install 2.4.190 and adding fleet integration pfsense and netflow no logs in SO SOC

[sleepingbel]

Version

2.4.150

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

48 GB

Storage for /

250

Storage for /nsm

2 TB

Network Traffic Collection

span port

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

Yes, there are additional clues in installation log /root/sosetup.log

WARNING: Errors detected during setup.
--------- ERRORS ---------
[INFO    ] {'pid': 190019, 'retcode': 0, 'stdout': 'Executing command with retry support: curl -s -K /opt/so/conf/elasticsearch/curl.config --output /dev/null --silent --head --fail localh>
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_12.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_13.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_4.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_5.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_6.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_7.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_8.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_9.json

Detail

Hello all,

The VM deployment is done on a linux/ubuntu host with virtualbox.

I have followed the manuel of SO for adding the Elastic integration PFsense and the netflow integration.

The logs arrive in Elastic, I can see both logs types in Kibana. But in the SO dashboards these logs are not visable, they remain empty.

The installation log give me this error:

WARNING: Errors detected during setup.
--------- ERRORS ---------
[INFO    ] {'pid': 190019, 'retcode': 0, 'stdout': 'Executing command with retry support: curl -s -K /opt/so/conf/elasticsearch/curl.config --output /dev/null --silent --head --fail localh>
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_12.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_13.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_4.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_5.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_6.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_7.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_8.json
                  Failed to complete a chunk of bulk package installs -- /tmp/esfleet_bulk_install_9.json

What could be cause of this?

Regards
Bart

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

When you try the dashboard, look in the /opt/so/log/soc/sensoroni-server.log and see if there is an indication on why the data is not visible in Dashboards.