keep live monitoring of security onion active

[pavlos1982]

Hi, after a while, I noticed that the security onion page goes inactive and time out, so I have to re-login the portal. Is there a way to keep the live monitoring active as I plan to put the live alert monitoring to a dedicated open screen? See the screenshot below. After a while of monitoring and leaving the refresh interval for 5 sec, it seems to time out or fails where I have to re-login to reaccess the alerts?

[jertel]

How long is "a while"?

See #4575.

[pavlos1982]

about 30 mins then I get this error status and I have to re-logged in. I will check the document thanks

[dougburks]

Also see #4586. I've added these steps to the SOC documentation:
https://docs.securityonion.net/en/2.3/soc.html

[pavlos1982]

thanks Doug, I will have a look

[pavlos1982]

it seems this is for the evaluation version but I have the standalone version and when trying to access the path :/opt/so/saltstack/local/pillar/minions/ I get access denied, and is there a way to set it indefinitely until the user sign out?

[dougburks]

You need root or sudo privileges to access /opt/so/saltstack/local/pillar/minions/ .

[pavlos1982]

I did try with sudo getting this error:

[pavlos1982]

it seems to still time out and I have to re logged in

[dougburks]

First, please note that you may want to redact keys like kratoskey when posting to a public forum like this.

Looking at your screenshot, it appears that sessiontimeout is not indented as shown at https://docs.securityonion.net/en/2.3/soc.html. Please try indenting and then restarting SOC to see if that changes anything. You can also check the logs at /opt/so/log/soc/ for additional clues.

[pavlos1982]

Thanks I made the change recommended see screenshot and I will report back:

[pavlos1982]

after 30 mins same message again:

[dougburks]

I wouldn't think you would get a timeout after only 30 minutes. Is your system healthy or could it be overloaded? What is the load average? Are you able to duplicate this on a fresh installation (perhaps just in a VM)?

[jertel]

Since you're the only one reporting this issue my best guess is you have something in your network, like a proxy or related device, that's interfering. I suggest trying some alternatives:

• Login using another browser
• Login using another computer
• Install SO on a completely separate network and compare results

[pavlos1982]

Thanks it is sorted now