Zeek error after upgrade version .190

[a3hiennt]

Dear SO teams.
I have issue related to zeek.
After I upgrade, I can't start so-zeek.
I run command 'docker logs so-zeek'. It show error message
`
/usr/local/sbin/zeek.sh: line 8: kill: (31) - No such process
checking configurations ...
logger scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 15: can't find icsnpp-s7comm

manager scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 15: can't find icsnpp-s7comm

proxy scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 15: can't find icsnpp-s7comm

worker-1-1 scripts failed.
fatal error in /opt/zeek/share/zeek/site/local.zeek, line 15: can't find icsnpp-s7comm

/usr/local/sbin/zeek.sh: line 8: kill: (32) - No such process
`
Please help me resolve this issue.
Thanks so much

[dougburks]

Did soup complete successfully?

Have you tried rebooting?

Have you previously modified your Zeek configuration?

Is this a standalone box or a distributed deployment?

What is the output of the following?

sudo docker images |grep zeek

sudo docker ps |grep zeek

[a3hiennt]

Did soup complete successfully?
--> it show completed, but when I check on SOC UI, it still show verrion 2.3.181
Have you tried rebooting?
--> Yes, I tried reboot both ManageSearch and Forward Node
Have you previously modified your Zeek configuration?
--> No, I don't change anything
Is this a standalone box or a distributed deployment?
--> This is a ManageSearch+ Forward
What is the output of the following?
-->

Please help me check.
Thanks

[MrDigitalDick]

Hi,

HELP!!!, Sorry to hijack this thread, but I too am having a similar issue where Zeek wont start now after upgrading to the new version. I have also rebooted to no avail.

Did soup complete successfully?
No, it had issues doing the update, and took forever to finally do it, i tried to run soup again and it says its up to date
Have you tried rebooting?
Yes
Have you previously modified your Zeek configuration?
Not to my knowledge
Is this a standalone box or a distributed deployment?
Standalone

[root@soprod ~]# sudo docker images |grep zeek
ghcr.io/security-onion-solutions/so-zeek 2.3.190 ebfb2d1d579f 9 days ago 2.16GB
soprod:5000/security-onion-solutions/so-zeek 2.3.190 ebfb2d1d579f 9 days ago 2.16GB
soprod:5000/security-onion-solutions/so-zeek 2.3.160 572fb79d8874 3 months ago 602MB
ghcr.io/security-onion-solutions/so-zeek 2.3.160 572fb79d8874 3 months ago 602MB
[root@soprod ~]#

When running sudo docker ps |grep zeek I just get a blank new line

Not sure if the issue is the same, and if you would rather I log a new post for this, let me know and i will re do it.

Thanks

[dougburks]

@MrDigitalDick Please do not hijack threads. Please start a separate discussion as mentioned here:
#1720

[dougburks]

@a3hiennt Seems like your forward node might be having trouble pulling something from your manager. Please run the following command on your forward node and look for any errors:

sudo so-checkin

[a3hiennt]

Thanks @dougburks , after I run "sudo so-checkin" command, zeek working again.
Thanks so much