Install had a problem 2026 FIX

[h5dm5tt3r]

Install “Had a Problem” Fix Advice

If you see:

Install had a problem. Please see /root/sosetup.log for details.

like i have had several times... nightmare...

There is actually a chance the install is actually working...

Here’s what to try:

Run:

sudo so-status

If it shows:

System appears to be starting. No highstate has completed since the system was restarted.

then your services haven’t fully started yet.

Run:

sudo so-checkin

Warning: This can take 10–60+ minutes depending on your VM specs, but it’s necessary.

so-checkin orchestrates all Docker-based services in the correct order, ensures dependencies are met, and starts everything properly.

After it finishes, run:

sudo so-status

If all containers show as running, your Security Onion VM is fully operational.

At this point, you can log in via the web UI and start monitoring traffic.

Note: The monitoring interface should not have an IP; it captures traffic at the NIC level.

Let me know how you get on.

[cm-ops]

Do you know what the error(s) in the /root/sosetup.log is?

[h5dm5tt3r]

It looks like a lot of failed installs. All of them say adding next update.

And then at the bottom 'Failed to complete a chink of bulk package installs'

Like I said above, the socheckin command seemed to get it working although this needs to be run every time if i shutdown the machine to get all the services up and running again. I have now resorted to just saving the state every time.

Any suggestions??

[cm-ops]

What was the MD5 of your ISO?

[h5dm5tt3r]

I checked the MD5 and SHA256 before installation.

Security Onion 2 Latest version: 2.4.200 ISO - securityonion-2.4.200-20251216

MD5: 07B38499952D1F2FD7B5AF10096D0043
SHA1: 7F3A26839CA3CAEC2D90BB73D229D55E04C7D370
SHA256: 8D3AC735873A2EA8527E16A6A08C34BD5018CBC0925AC4096E15A0C99F591D5F

[cm-ops]

Try to reset Fleet and see if that fixes the package issues above. sudo so-elastic-fleet-reset