Fault on manager, with one docker container called "missing" with "ERROR"

[cakelly]

Version: SecurityOnion 2.3.200.
SO Grid page shows a "FAULT" on my so manager node. The sensor nodes are all OK. I am seeing pretty normal behavior, but this oddity for so-status, a "missing" service, which has "ERROR" status, naturally. I assume one of the SO dockers is not running, but docker commands are not showing an issue. Not sure where to turn.

so-status

Checking Docker status

    Docker ------------------------------------------------------------------------------------- [ OK ]

Checking container statuses

    missing --------------------------------------------------------------------------------- [ ERROR ]
    so-aptcacherng ----------------------------------------------------------------------------- [ OK ]
    so-curator --------------------------------------------------------------------------------- [ OK ]
    so-dockerregistry -------------------------------------------------------------------------- [ OK ]
    so-elastalert ------------------------------------------------------------------------------ [ OK ]
    so-elasticsearch --------------------------------------------------------------------------- [ OK ]
    so-filebeat -------------------------------------------------------------------------------- [ OK ]
    so-fleet ----------------------------------------------------------------------------------- [ OK ]
    so-grafana --------------------------------------------------------------------------------- [ OK ]
    so-idstools -------------------------------------------------------------------------------- [ OK ]
    so-influxdb -------------------------------------------------------------------------------- [ OK ]
    so-kibana ---------------------------------------------------------------------------------- [ OK ]
    so-kratos ---------------------------------------------------------------------------------- [ OK ]
    so-logstash -------------------------------------------------------------------------------- [ OK ]
    so-mysql ----------------------------------------------------------------------------------- [ OK ]
    so-nginx ----------------------------------------------------------------------------------- [ OK ]
    so-playbook -------------------------------------------------------------------------------- [ OK ]
    so-redis ----------------------------------------------------------------------------------- [ OK ]
    so-sensoroni ------------------------------------------------------------------------------- [ OK ]
    so-soc ------------------------------------------------------------------------------------- [ OK ]
    so-soctopus -------------------------------------------------------------------------------- [ OK ]
    so-telegraf -------------------------------------------------------------------------------- [ OK ]
    so-wazuh ----------------------------------------------------------------------------------- [ OK ]

What is this?

Also ran "salt-call state.highstate", which returned no errors.

[cakelly]

Found it! This "missing ... [ERROR]" container was caused by a blank line in the file /opt/so/conf/so-status/so-status.conf, which when removed, causes the anomalous line go away, as well as the "FAULT" shown in the "Grid" panel in SOC. I also increased the memory on the somanager. This may have helped as well. Was 16gb, now 32gb.