Cannot install Security Onion Standalone

[thetayo]

I cannot seem to install Security Onion standalone. I have tried at least 20 times. i set it up using Vmware, Proxmox, and Virtualbox. and i always seem to get an error towards the end. i made sure the VM requirements matched the hardware requirements on the website. Is there anything i might be missing? See screenshot below.

[konceptnet]

can you post the /root/errors.log and /root/sosetup.log please

[thetayo]

/root/errors.log is empty.

for /root/sosetup.log

---

      ID: prune_images
Function: cmd.run
    Name: so-docker-prune
  Result: True
 Comment: Command "so-docker-prune" run
 Started: 11:13:25.947366
Duration: 263.812 ms
 Changes:   
          ----------
          pid:
              9373
          retcode:
              0
          stderr:
          stdout:
              Pruning old containers
              No Security Onion images to prune

---

      ID: load_elastic_pipelines
Function: cmd.run
    Name: /usr/sbin/so-filebeat-module-setup
  Result: True
 Comment: Command "/usr/sbin/so-filebeat-module-setup" run
 Started: 11:13:26.211577
Duration: 151312.952 ms
 Changes:   
          ----------
          pid:
              9377
          retcode:
              0
          stderr:
          stdout:
              Waiting for ElasticSearch...connected!

Testing to see if the pipelines are already applied
Setting up ingest pipeline(s)
Loading activemq
Loaded Ingest pipelines
Loading apache
Loaded Ingest pipelines
Loading auditd
Loaded Ingest pipelines
Loading aws
Loaded Ingest pipelines
Loading azure
Loaded Ingest pipelines
Loading barracuda
Loaded Ingest pipelines
Loading bluecoat
Loaded Ingest pipelines
Loading cef
Loaded Ingest pipelines
Loading checkpoint
Loaded Ingest pipelines
Loading cisco
Loaded Ingest pipelines
Loading coredns
Loaded Ingest pipelines
Loading crowdstrike
Loaded Ingest pipelines
Loading cyberark
Loaded Ingest pipelines
Loading cylance
Loaded Ingest pipelines
Loading elasticsearch
Loaded Ingest pipelines
Loading envoyproxy
Loaded Ingest pipelines
Loading f5
Loaded Ingest pipelines
Loading fortinet
Loaded Ingest pipelines
Loading gcp
Loaded Ingest pipelines
Loading google_workspace
Loaded Ingest pipelines
Loading googlecloud
Loaded Ingest pipelines
Loading gsuite
Loaded Ingest pipelines
Loading haproxy
Loaded Ingest pipelines
Loading ibmmq
Loaded Ingest pipelines
Loading icinga
Loaded Ingest pipelines
Loading iis
Loaded Ingest pipelines
Loading imperva
Loaded Ingest pipelines
Loading infoblox
Loaded Ingest pipelines
Loading iptables
Loaded Ingest pipelines
Loading juniper
Loaded Ingest pipelines
Loading kafka
Loaded Ingest pipelines
Loading kibana
Loaded Ingest pipelines
Loading logstash
Loaded Ingest pipelines
Loading microsoft
Loaded Ingest pipelines
Loading mongodb
Loaded Ingest pipelines
Loading mssql
Loaded Ingest pipelines
Loading mysql
Loaded Ingest pipelines
Loading nats
Loaded Ingest pipelines
Loading netscout
Loaded Ingest pipelines
Loading nginx
Loaded Ingest pipelines
Loading o365
Loaded Ingest pipelines
Loading okta
Loaded Ingest pipelines
Loading osquery
Loaded Ingest pipelines
Loading panw
Loaded Ingest pipelines
Loading postgresql
Loaded Ingest pipelines
Loading rabbitmq
Loaded Ingest pipelines
Loading radware
Loaded Ingest pipelines
Loading redis
Loaded Ingest pipelines
Loading santa
Loaded Ingest pipelines
Loading snort
Loaded Ingest pipelines
Loading snyk
Loaded Ingest pipelines
Loading sonicwall
Loaded Ingest pipelines
Loading sophos
Loaded Ingest pipelines
Loading squid
Loaded Ingest pipelines
Loading suricata
Loaded Ingest pipelines
Loading system
Loaded Ingest pipelines
Loading threatintel
Loaded Ingest pipelines
Loading tomcat
Loaded Ingest pipelines
Loading traefik
Loaded Ingest pipelines
Loading zeek
Loaded Ingest pipelines
Loading zscaler
Loaded Ingest pipelines

      ID: lasthighstate
Function: file.touch
    Name: /opt/so/log/salt/lasthighstate
  Result: True
 Comment: Created empty file /opt/so/log/salt/lasthighstate
 Started: 11:15:57.524926
Duration: 2.033 ms
 Changes:   
          ----------
          new:
              /opt/so/log/salt/lasthighstate

Summary for local

Succeeded: 601 (changed=53)
Failed: 7

Total states run: 608
Total run time: 2076.181 s
Errors detected during setup; skipping post-setup steps to allow for analysis of failures.

Stopping mysql...

so-mysql
so-mysql
2022-02-23T14:19:57Z | I | Removing so-setup permission entry from sudoers file

[konceptnet]

Are you installing with a CD/ISO or with the network ?

[thetayo]

i am installing it with an ISO.

[techn00]

I am facing same issue. I am installing with ISO on Hyper V box.

Got the same error
so-mysql
so-mysql
2022-02-23T13:01:57Z | I | Removing so-setup permission entry from sudoers file

so-status says suricata is missing

[Jakes-Lab]

I'm able to reproduce this in ESXi when setting the guest OS version to centos. Changing it to "other linux (64 bit)" will allow the install to run without issue.

[dougburks]

@Jakes-Lab I'm not sure why that would be unless your centos option is using lower hardware specs. Please see https://docs.securityonion.net/en/2.3/hardware.html and if you'd like to troubleshoot further, please start a separate discussion to avoid confusion.

[dougburks]

@thetayo Please provide more information:

• Are you using our Security Onion ISO image? If so, did you verify it using hashes or gpg?
• What are your exact hardware specs?
• What options are you choosing in Setup?
• Are you able to share the full sosetup.log?

[thetayo]

@Jakes-Lab 's solution seems to have worked. thank you. i have tried this at least twice and it works fine.

@dougburks in answer to your question. i am using virtualbox with 12gb ram, 4 cores and 200gb hard disk. once i begin the setup, it gets to about 78% thereabouts and comes back with the error in the screenshot above

[dougburks]

I'm still not sure why choosing other linux (64 bit) would make a difference assuming the hardware specs are the same.

• What options are you choosing in Setup?
• Are you able to share the full sosetup.log?

[bumfighter]

Was this problem ever resolved? I'm having the same issue and have tried installing 2.4 at least 9 times.

[reyesj2]

Please create a new discussion for your issue. That way you can include the information about your hardware + relevant logs for review. This discussion is 2 years old and not the same version of Security Onion you're looking at installing.