soup resets max pcap files

[jomer12]

Hi all,
I have SO 2.3.130 installed in standalone deployment, I have change max files to 70000 and is working perfect for a long time.
I done soup within 2.3.130 (I mean not update from previous version) and then max files reset to 30000 and deleted the rest.
Now I plan to soup in 2.3.140 and I need to keep 70000 files and not loose them during soup.
Is it any way to keep 70000 files during soup and not delete the rest ?

[dougburks]

Where exactly did you change the maxfiles setting?

From https://docs.securityonion.net/en/2.3/stenographer.html#maximum-files:

This is controlled by the maxfiles option in the steno section of the Salt pillar.

[jomer12]

Thank you for your response.
I have change exactly:
/opt/so/saltstack/default/salt/pcap/files/config
and
/opt/so/conf/steno/config

[dougburks]

Files in /opt/so/saltstack/default/ are overwritten by soup. If you'll instead make your change in the steno section of your minion file in /opt/so/saltstack/local/pillar/minions/* (per the documentation), then it won't be overwritten.

[jomer12]

Many thanks for reply!!

In /opt/so/saltstack/local/pillar/minions/* there is only one file with name so-xx_standalone.sls
The only section in the above file with steno is:
steno:
enabled: True

and nowhere maxfiles parameter so to be able to change it

I have read the documentation but no relevant minion in my configuration

Also in /opt/so/saltstack/local/pillar/ no relevant with steno file

[dougburks]

Just add the maxfiles parameter to /opt/so/saltstack/local/pillar/minions/so-xx_standalone.sls with the proper spacing.

For example:

steno:
  enabled: true
  maxfiles: 120000

[jomer12]

Thank You so much. It is working perfectly. Soup from 2.3.130 to 2.3.140 without any problem and maxfiles remain unchaged.
Thank you again.