[ERROR] Exception during resolving address: [Errno 2] Host name lookup failure

[tientmse62290]

OS: Ubuntu 20.04
Install from repo v2.3.120
Master Node

Hostname changed before run so-setup-network

After complete the installation, I changed the urlbase in the file: /opt/so/saltstack/local/pillar/global.sls
From IP add to:
url_base: 'threat.abc.com'
salt highstate and got the "[ERROR ] Exception during resolving address: [Errno 2] Host name lookup failure" on the first lines of output.

After that I tried to add my own account for analyst but got the error:

so-user-add [email protected]
Enter new password:
Syncing users and roles between SOC and Elastic...
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
Elastic state will be re-applied to affected minions. This may take several minutes...
Successfully added new user to SOC
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
[ERROR   ] Exception during resolving address: [Errno 2] Host name lookup failure
Successfully added user to Fleet

Any idea to fix that?

[dougburks]

Based on the error message, are you able to resolve the host name?

[tientmse62290]

Yes I can resolve the hostname via ping and nslookup command

[tientmse62290]

From the alert page
{"timestamp":"2022-05-08T23:58:46.719+0000","rule":{"level":2,"description":"Unknown problem somewhere in the system.","id":"1002","firedtimes":589,"mail":false,"groups":["syslog","errors"],"gpg13":["4.3"]},"agent":{"id":"001","name":"somaster141","ip":"10.90.92.141"},"manager":{"name":"somaster141-wazuh-manager"},"id":"1652054326.4452531","full_log":"May 8 23:58:45 somaster141 salt-minion[3067]: [ERROR ] Exception during resolving address: [Errno 2] Host name lookup failure","predecoder":{"program_name":"salt-minion","timestamp":"May 8 23:58:45","hostname":"somaster141"},"decoder":{},"location":"/var/log/syslog"}

[dougburks]

To clarify, when you resolve the hostname via nslookup, are you doing it from the Security Onion box itself (via ssh)?

Does the Security Onion box have an entry for the host name in /etc/hosts and/or do you have an entry in your DNS for that hostname?

[tientmse62290]

Yes I do it from the OS box on master node
I I have entries in the /etc/hosts

root@somaster141:/home/pam# cat /etc/hosts
127.0.0.1   somaster141 somaster141.localdomain localhost localhost.localdomain localhost4 localhost4.localdomain
::1   somaster141 somaster141.localdomain localhost localhost.localdomain localhost6 localhost6.localdomain6

on the DNS I only have a entry for the domain of web interface. I use a internal reverse proxy pointing to the SO web interface and apply my company certificate