IDH not working

[warrenmcdaniel]

Version

3.2.0

Installation Method

Security Onion ISO image

Description

configuration

Installation Type

Standalone

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

128

Storage for /

lots

Storage for /nsm

lots

Network Traffic Collection

tap

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

No, there are no additional clues

Detail

Hello

I am having an issue with the IDH working. Everything shows good in the grid, but When I got to test the honeypot nothing gets generated. I can temporarily get it to work when I reboot the node. Once it comes fully online, it stops working again.

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Can you expand on not working? If you are meaning you don't see any logs from your IDH node, then check connectivity and elastic agent status. You can check the connectivity of the logging with this command from your manager node -- sudo salt \*idh network.connect $IP_MANAGER 5055 (replace $IP_MANAGER with your manager's IP address). If that shows connected and fine, next check the elastic agent with -- sudo salt \*idh cmd.run "elastic-agent status"

If there is a different issue, then let me know what it is.

[cm-ops]

Are you able to produce the output of the above commands? How about the salt-minion log at /opt/so/log/salt/minion?

[warrenmcdaniel]

[root@soc1 ~]# tail /opt/so/log/salt/minion
2026-08-18 21:07:17,470 [salt.state :2368][INFO ][36067] Executing state file.touch for [/opt/so/log/salt/state-apply-test]
2026-08-18 21:07:17,487 [salt.state :316 ][INFO ][36067] {'touched': '/opt/so/log/salt/state-apply-test'}
2026-08-18 21:07:17,487 [salt.state :2535][INFO ][36067] Completed state [/opt/so/log/salt/state-apply-test] at time 21:07:17.487641 (duration_in_ms=18.176)
2026-08-18 21:07:17,497 [salt.minion :2328][INFO ][7220] Returning information for job: req
2026-08-18 21:07:27,053 [salt.utils.schedule:1792][INFO ][7220] Running scheduled job: push_drain_schedule with jid 20260818210727053122
2026-08-18 21:07:27,249 [salt.loaded.int.module.cmdmod:456 ][INFO ][38417] Executing command '/usr/sbin/so-push-drainer' in directory '/root'
2026-08-18 21:07:42,053 [salt.utils.schedule:1792][INFO ][7220] Running scheduled job: push_drain_schedule with jid 20260818210742052968
2026-08-18 21:07:42,249 [salt.loaded.int.module.cmdmod:456 ][INFO ][39905] Executing command '/usr/sbin/so-push-drainer' in directory '/root'
2026-08-18 21:07:57,052 [salt.utils.schedule:1792][INFO ][7220] Running scheduled job: push_drain_schedule with jid 20260818210757052642
2026-08-18 21:07:57,244 [salt.loaded.int.module.cmdmod:456 ][INFO ][41725] Executing command '/usr/sbin/so-push-drainer' in directory '/root'

[cm-ops]

Was that minion log from your manager or IDH node?

[warrenmcdaniel]

The manager.

[cm-ops]

I would need to see the output from the IDH node salt minion log.

[warrenmcdaniel]

[cm-ops]

Would you run a highstate on your IDH node and let me know if anything fails. sudo salt-call state.highstate

Also, please check the logs here on the IDH node /nsm/idh for any logs for your test on the honeypot. If you see the logs there, check your Elastic agent status on your node with sudo elastic-agent status.

These snippets are not enough for me to try and diagnose. I would need more of the logs than 25 lines of a tail command.