Zeek issues after upgrading to latest version

[MrDigitalDick]

Hi Doug,

I have run the following as you mentioned and get the below, When you say run on forward node, I only have the one standalone so I ran it on that.

[root@soprod ~]# sudo so-checkin
local:
Data failed to compile:

The function "state.highstate" is running as PID 9764 and was started at 2022, Dec 08 15:59:18.139978 with jid 20221208155918139978

[root@soprod ~]# ^C
[root@soprod ~]#

[dougburks]

If you get that message, it simply means that the salt cron job is already running and you should just wait a few minutes and try again. Once so-checkin starts running, examine the output for any errors.

[MrDigitalDick]

Hi Doug,

I have tried a fair few times now and still says missing in so-status. Its been like it for around 3 days now. I noticed it was still on .160 while everything else was on .190, is there a way to force an update? Is there anything else I can do to try and find the root cause to resolve it?

Kind regards,
Rich

[MrDigitalDick]

After running so-checkin i get the below:

---

      ID: so-zeek
Function: docker_container.running
  Result: False
 Comment: One or more requisite failed: zeek.zeekpolicysync
 Started: 09:26:55.709028
Duration: 0.016 ms
 Changes:

---

Summary for local

Succeeded: 797 (changed=44)
Failed: 2

Total states run: 799
Total run time: 379.224 s

[dougburks]

Copying your previous information from #9331 so that we have it all here.

Did soup complete successfully?
No, it had issues doing the update, and took forever to finally do it, i tried to run soup again and it says its up to date
Have you tried rebooting?
Yes
Have you previously modified your Zeek configuration?
Not to my knowledge
Is this a standalone box or a distributed deployment?
Standalone

[root@soprod ~]# sudo docker images |grep zeek
ghcr.io/security-onion-solutions/so-zeek 2.3.190 ebfb2d1d579f 9 days ago 2.16GB
soprod:5000/security-onion-solutions/so-zeek 2.3.190 ebfb2d1d579f 9 days ago 2.16GB
soprod:5000/security-onion-solutions/so-zeek 2.3.160 572fb79d8874 3 months ago 602MB
ghcr.io/security-onion-solutions/so-zeek 2.3.160 572fb79d8874 3 months ago 602MB
[root@soprod ~]#

When running sudo docker ps |grep zeek I just get a blank new line

[dougburks]

Looking at your so-checkin output above, it says Failed: 2. I see the zeekpolicysync failure above that, but what was the other failure?

[MrDigitalDick]

Would this be it?

Changes:

---

      ID: zeekpolicysync
Function: file.recurse
    Name: /opt/so/conf/zeek/policy
  Result: False
 Comment: #### /opt/so/conf/zeek/policy/intel/misp-intel.dat ####
          Unable to manage file: Jinja syntax error: expected token 'end of print statement', got 'Date'; line 45

          ---
          [...]
                  <router-view></router-view>
                </v-main>
                <v-footer app inset>
                  <v-spacer></v-spacer>
                  <span class="center text-no-wrap">
                    &copy; {{ new Date().getFullYear() }} <a class="footer" target="sos" href="https://securityonionsolutions.com/">Security Onion Solutions, LLC</a>    <======================
                  </span>
                  <v-spacer></v-spacer>
                </v-footer>
              </v-app>

          [...]
          ---
 Started: 09:26:39.864777
Duration: 15325.833 ms
 Changes:

---

[dougburks]

Yes, that's definitely an issue. It looks like you've manually installed MISP as it's not installed by default. I'd start with disabling MISP and removing misp-intel.dat to get Zeek back up and running.

[MrDigitalDick]

Thanks Doug, whats the best way to disable or uninstall MISP, as we no longer use it?

[MrDigitalDick]

Hi Doug,

Can you advise what is the best way to to disable MISP and how best to remove MISP-INTEL.DAT and where it maybe located? Any help would be gratefully received.

Reagrds,
Rich

[weslambert]

misp-intel.dat is written to the following location:

/opt/so/saltstack/local/salt/zeek/policy/intel/misp-intel.dat

You'll also want to make sure the downstream configuration in /opt/so/conf/zeek/policy/intel/misp-intel.dat is removed.

After removing the files, restart services.

You may also want to remove the intel download cron job, located here:

/etc/cron.d/so-misp-download

[MrDigitalDick]

Perfect, we have all green lights again. Thank you so much for your help and resolving.