SecurityOnion 2.3.130 soup upgrade to .140 not working

[TotieBash]

SecurityOnion 2.3.130 soup upgrade to .140 not working with errors below. I checked /root/soup.log but nothing obvious is sticking out. The only error I see is "ERROR: salt-master could not be reached....." This is my lab virtual machine so I have reverted snapshot 3 times now and I get to the same error. I check the md5sum of the iso and compare it with the download page and it looks good. Help pls....

• SYSTEM INFO: SecurityOnion 2.3.130 Standalone
• NEW UPDATE ISO FILE: securityonion-2.3.140-20220719.iso
• SO INSTALL TYPE: SecurityOnion ISO image install
• SO INSTALL TYPE: air-gap install

[reyesj2]

Can you ping your saltmaster

sudo salt '*' test.ping

[TotieBash]

[TotieBash]

Ok I got pass the first issue. @reyesj2 reply pointed me to the right direction. The theory is salt was being impatient and not waiting for salt to fully start. So needed to insert "sleep 120" somewhere in soup. The caveat is /sbin/soup is guarded by salt so I can't just tweak it so here is the process that I did.

1. Run the first phase of 'soup -y -f /dev/sr0'. This process updates the /sbin/soup file to the latest. '/dev/sr0' is my media drive where the latest iso.
2. copy the latest /sbin/soup /home/admin
   I copied mine to /home/admin/
3. vim /home/admin/soup and insert "sleep 120" (for mine 120 seconds was enough)
   
4. Run the second phase soup using the edited soup file: /home/admin/soup -y -f /dev/sr0
   The installer now pass the section where I had troubles with
   

However I am now on a new error but I think this is the same filebeat error in #8324 and others had issue. I just need to dig around for the fix. If someone can link me to the fix I would really appreciate it.

[dougburks]

Have you previously modified your Filebeat configuration in /opt/so/saltstack/local/salt/filebeat/?

If so, try reverting to snapshot and then removing your Filebeat modifications.

Check this discussion for additional details:
#8372

[TotieBash]

Yes. I edited '/opt/so/saltstack/local/salt/filebeat/init.sls' to enable Cisco IOS-XE module in ingesting logs.

[TotieBash]

ok I will try that..

[TotieBash]

Ok. It does not look like it succeeded. Or does it?

so-status looks good

docker ps looks like they are running the latest .140

docker images looks like updated

I can get to SOC and /grafana. However /kibana is not working. I will let it marinate for 15 minutes and then I will reboot it. I will dig through other threads I think I saw someone with this same Kibana issue afeter 140 upgrade. If someone has idea please send me link. Thanks @dougburks for directing me to the fix.

[TotieBash]

ok /kibana is back to normal again.

This fixed it for me #8335

My Elastic Auth is already enabled so I did not need this one

Thanks you @weslambert and the entire SecurityOnion team..