Zeek is Missing After Running soup

[RBrownSoME]

Version

2.4.200

Installation Method

Security Onion ISO image

Description

upgrading

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

96

RAM

376G

Storage for /

445G

Storage for /nsm

777T

Network Traffic Collection

tap

Network Traffic Speeds

1Gbps to 10Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

I ran soup last night to update from 2.4.180 to 2.4.201. Since the update Zeek has not been running, and shows as "Missing" when I run sudo -so-status. Result from sudo docker logs so-zeek shows errors seen below:

checking configurations ...
logger scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 3: can't find tuning/defaults

manager scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 3: can't find tuning/defaults

proxy scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 3: can't find tuning/defaults

worker-1-1 scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 3: can't find tuning/defaults

The folder /opt/zeek/ does not exist on my server. I don't see any related errors in /root/soup.log either.

Finally, if I run sudo salt-call state.apply zeek queue=True then Zeek will go into "Starting" status but eventually fail.

Any help would be appreciated!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[RBrownSoME]

One more thing to add... I have set the number of workers used by Zeek to 20, based on a suggestion I found in a post from last year. That hasn't helped.

[RBrownSoME]

More info to add... I have tried running sudo so-checkin and sudo so-docker-refresh to no avail. sudo docker images returns the following related to so-zeek:

ghcr.io/security-onion-solutions/so-zeek                                        2.4.201   98d459e8f158   4 weeks ago     1.05GB
securityonion:5000/security-onion-solutions/so-zeek                             2.4.201   98d459e8f158   4 weeks ago     1.05GB

[RBrownSoME]

I found a solution here:
#15336