SO2.3 Check Version Running

[joeb1kenobe]

Is there a command that can be run to detect which version of Security Onion is installed. Specifically, I want to make sure that each of the members of my distributed deployment are being upgraded properly.

Thank you

[TOoSmOotH]

sudo salt \* so.status will display status on all machines connected to the grid. If it is connected to the grid, it will automatically update to the latest and greatest. When you update the grid you are updating everything connected to it as they check in. (15 minutes by default)

[joeb1kenobe]

I ran some tests running:

docker container ls

on each of the nodes in my grid. I noticed that salt seemed to be updating the docker images. However, with the exception of the manager, the other nodes didn't seem to be running the latest version. Then, on each node, I stopped and started the container that needed to be updated. After a restart, then the container was running the correct version.

It does look like salt is updating properly, but after the update, it doesn't appear that the container is restarted.

Should salt restart the containers? Or is it done this way to allow for controlled restart of the containers?

[TOoSmOotH]

So salt does not automatically restart retagged images. From 2.3.1 to 2.3.2, we re-tagged all the containers that were not being updated. This makes it so you don't have to re-download/restart a bunch of things on the grid when only 1 or 2 containers are changing. Salt and Docker are looking at the checksum of the image and since the actual checksum doesn't change just the tag it doesn't restart. Only when the container is restarted does it replace the tag value in "docker ps".

[joeb1kenobe]

So, if I understand correctly, docker ps will not update to show 2.3.2 until after a restart. But salt will only restart a container if the container actually changed. That would make since I would see some containers running the 2.3.2 version and others the 2.3.1 version. If I wanted to make sure that all my containers showed correctly - at the end of an update process could I restart docker to restart the containers?

…

On Mon, Nov 2, 2020 at 10:38 AM Mike Reeves ***@***.***> wrote: So salt does not automatically restart retagged images. From 2.3.1 to 2.3.2, we re-tagged all the containers that were not being updated. This makes it so you don't have to re-download/restart a bunch of things on the grid when only 1 or 2 containers are changing. Salt and Docker are looking at the checksum of the image and since the actual checksum doesn't change just the tag it doesn't restart. Only when the container is restarted does it replace the tag value in "docker ps". — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1670 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAD6W6RET27I74TFV77AUI3SN3HANANCNFSM4TAXPBNA> .

-- Joe Brown

[TOoSmOotH]

Yes you could restart docker then run a salt-call state.highstate. This will only be a factor on quick fix/security releases. Larger releases like 2.3.10 will be all new containers.

[SanibelJack]

Hello,
I ran the above command "sudo salt * so.status" and found that my sensor is missing suricata, that's probably bad and that the Managersearch machine is missing aptcaching and idstools... That also sounds bad... Shouls I reload or is there a command to force these services to install?

[TOoSmOotH]

@SanibelJack Please start a new thread