Problem with installation SO 2.3.2 on Proxmox VM

[mjakubowskilkr]

I'm trying install SO 2.3.2 on Proxmox VM and have message "Install had a problem". I've tried 3 times and every time had the same error. I've got only one error in sosetup.log :
67% - APPLYING ZEEK SALT STATE

[INFO ] Loading fresh modules for state activity
[INFO ] Fetching file from saltenv 'base', ** done ** 'zeek/init.sls'
[INFO ] Loading fresh modules for state activity
[INFO ] Running state [zeek_state_not_allowed] at time 20:15:56.323219
[INFO ] Executing state test.fail_without_changes for [zeek_state_not_allowed]
[ERROR ] Failure!
[INFO ] Completed state [zeek_state_not_allowed] at time 20:15:56.325554 (duration_in_ms=2.336)
local:

      ID: zeek_state_not_allowed
Function: test.fail_without_changes
  Result: False
 Comment: Failure!
 Started: 20:15:56.323218
Duration: 2.336 ms
 Changes:

How can I fix it?

[netsecninja]

I installed 2.3.2 from ISO in Proxmox and the install worked for me. What's your VM specs? Just for comparison, here's mine:

[mjakubowskilkr]

I've set the same bridge on both interfaces for test only. I didn't set physically log collection and I'll change it when I'll connect server NIC to the switch mirrored port. It should not cause that problem I think.

[mjakubowskilkr]

I've reinstalled SO with Zeek for metadata and installation finished correct. So the vm spec is not the issue. But I still don't know why it happen.

[mjakubowskilkr]

I've tried on new vm and installation with Zeek is ok but with Suricata ends with errors. What is the difference between Zeek & Suricata as metadata source? Is it possible to change it after install?

[netsecninja]

Perhaps you can try to edit /opt/so/saltstack/local/pillar/global.sls to this:

global:
  mdengine: 'SURICATA'

I'm not sure how to affect that change as I'm not that familiar with salt. Perhaps sudo salt <hostname_role> state.highstate?

[mjakubowskilkr]

I've tried to change SURICATA to ZEEK on failed instance. After restart all services started correctly (so-status shows all ok) but webinterface shows only error 500. But when I've changed ZEEK to SURICATA on good installation, it works ok after restart. I don't know what's the difference between Zeek & Suricata as metadata source so I'll test both instances, one with Zeek and other with Suricata.