search

Security-Onion-Solutions / securityonion

Security Onion is a free and open platform for threat hunting, enterprise security monitoring, and log management. It includes our own interfaces for alerting, dashboards, hunting, PCAP, detections, and case management. It also includes other tools such as osquery, CyberChef, Elasticsearch, Logstash, Kibana, Suricata, and Zeek.
https://securityonion.net
3.28k stars 507 forks source link

FIX: Disabling steno raises errors when applying state.highstate / running soup update #4922

Closed TOoSmOotH closed 3 years ago

TOoSmOotH commented 3 years ago

Discussed in https://github.com/Security-Onion-Solutions/securityonion/discussions/4919

Originally posted by **TheRealPancakes** July 23, 2021 I'm seeing this issue across several installations so I don't believe it's specific to me. Currently running SO 2.3.61, but I believe I experienced the same error in earlier revisions. steno is disabled in **/opt/so/saltstack/local/pillar/global.sls** ``` steno: enabled: false ``` so-status confirms state **DISABLED**. **sudo salt-call state.highstate --state-output=mixed** ``` [ERROR ] The following container(s) are absent: so-steno ... Name: /opt/so/log/stenographer - Function: file.directory - Result: Clean Started: - 20:32:16.637327 Duration: 1.752 ms ---------- ID: so-steno Function: docker_container.stopped Result: False Comment: The following container(s) are absent: so-steno Started: 20:32:16.643720 Duration: 9.082 ms Changes: Name: /opt/so/conf/so-status/so-status.conf - Function: file.append - Result: Clean Started: - 20:32:16.653297 Duration: 35.748 ms ... Summary for local -------------- Succeeded: 632 (changed=25) Failed: 1 ``` Additionally, I believe this bubbles up as a unhandled error (Failed: 1 in local summary) during soup runs where an upgrade is performed.
dougburks commented 3 years ago

Security Onion 2.3.61 Hotfix for STENO and CSP Now Available! https://blog.securityonion.net/2021/07/security-onion-2361-hotfix-for-steno.html