"Rendering SLS 'global' failed. Please see master log for details."

[Shorider]

Currently running Security Onion Master v18.04 on a linux box running CentOS 7.

I run sudo soup
Enter password

SOUP - Security Onion UPdater

Please review the following for more information about the update process and recent updates:
https://docs.securityonion.net/soup
https://blog.securityonion.net

Press Enter to continue or Ctrl-C to cancel.

Preparing soup at Wed Jan 26 14:52:56 UTC 2022

There is an issue rendering the manager's pillars. Please correct the issues in the sls files mentioned below before running SOUP again.

"Rendering SLS 'global' failed. Please see master log for details."

I am unsure which logs to look at and where I could find them. I have searched through other posts, but have not been able to successfully find an answer or an idea to point me in the right direction. Any assistance would be appreciated.

[dougburks]

Currently running Security Onion Master v18.04 on a linux box running CentOS 7.

I'm not sure what this means since there is no Security Onion v18.04. Do you mean 2.3.x? You can find the version in /etc/soversion.

There is an issue rendering the manager's pillars. Please correct the issues in the sls files mentioned below before running SOUP again.

You can read more about Salt pillars and sls files here:
https://docs.securityonion.net/en/2.3/salt.html#salt

This usually means that somebody has edited one of the sls files and introduced a typo somewhere.

[innovate-support]

I ran into this same problem today after I updated. I haven't figured out yet what my exact typo was, but I had many threshholding filtering rules set in my global.sls file. I made a backup of the file, then deleted all my thresholding rules. The docker containers status all went green OK. Now I will be entering filter rules back in as needed.