-
|
Hi all, we just built a new SO server on a physical box. We set it up as distributed and as manager search node. Should it also be able to monitor traffic? If so, the bond0 interface doesn't show up. During setup it asks which interface to use for management but it doesn't ask for monitoring interfaces. I tried to add a physical interface using so-monitor-add but it failed because bond0 isn't there. We installed 2.3.160 but we couldn't install directly from the ISO. We kept getting a blinking cursor. So we installed CentOS7 then pulled down Security Onion. Please let me know if I need to provide more info. Thank you! |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 2 replies
-
|
Did you follow the steps detailed in installation on Ubuntu or CentOS ? |
Beta Was this translation helpful? Give feedback.
-
|
Yes. That is exactly what we used. |
Beta Was this translation helpful? Give feedback.
-
|
A manager search node is a manager and a search node, but it is not a sensor so there is no monitoring interface. For more information, please see: |
Beta Was this translation helpful? Give feedback.
-
|
Thank you. I've only used the Standalone in the past and didn't notice that the manager wouldn't include a sniffer. Makes sense. |
Beta Was this translation helpful? Give feedback.
A manager search node is a manager and a search node, but it is not a sensor so there is no monitoring interface. For more information, please see:
https://docs.securityonion.net/en/2.3/architecture.html#manager-search