Security Onion 2.4.60 - Network Install for Ubuntu

[NeoLife-iT]

Version

2.4.60

Installation Method

Network installation on Ubuntu

Description

installation

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

24

RAM

256

Storage for /

500Gig

Storage for /nsm

350Gig

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

1Gbps to 10Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

Yes, there are salt failures (please provide detail below)

Logs

Yes, there are additional clues in /opt/so/log/ (please provide detail below)

Detail

After install from ISO using the OL9 for 70 times and various configuration. I must concluded that OL9 is not working with my hyper-V Cluster - Please refer to this thread.

#12525

My Hyper-V Cluster worked great with Ubuntu and We have them in production environment for years no issue.
-First attempted network installation worked I was able to moved this installation around different host and function properly as it should. ...need more testing around but so far the networking issue is none....

-Question: When is the current release version available for network installation?

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

Have you seen this? https://docs.securityonion.net/en/2.4/network-installation.html

[NeoLife-iT]

Yes! I did follow that and got whole process done - But when it boot up it is Oracle Linux not the ubuntu original OS - same as install from ISO - The upgrade overridden the underline OS -

If you can fix that I am home free from there. I run ubuntu network install but t came out older version if upgrade it turn out Oracle Linux so I can not run it on my network - thanks

[petiepooo]

I have successfully installed 2.4 (.50) on Ubuntu 22.04. Running the 'so-setup-network' command as specified at step 7 of https://docs.securityonion.net/en/2.4/network-installation.html#installing-via-the-network definitely does not overwrite the OS. Check the date stamps of apt-get calls in your sosetup.log for proof (that command would not work on OL9).
Perhaps you have installed Ubuntu to a different virtual drive, and after installing 2.4 grub is reverting back to an old OL9 boot entry. Maybe try deleting the VM entirely and creating a new one from scratch to ensure there's no OL9 install for it to find?

[NeoLife-iT]

Hi Pete can you now upgrade your install to latest version follow instruction here. Please have checkpoint for your vm so you can undo
I did this and got the OL9 when it done.
https://docs.securityonion.net/en/2.4/appendix.html

[petiepooo]

I am running on bare metal; no checkpoints for me. I have followed the 2.3->2.4 upgrade doc you linked, but modified it to upgrade from Ubuntu 20.04 to Ubuntu 22.04 via do-release-upgrade, not by installing OL9 from ISO. I'm still working out the process to avoid breaks in coverage.

Have you deleted your VM and created a new VM with a fresh Ubuntu22/SO2.4 install yet before assigning a task for me to help debug your issue? I assure you, neither soup nor so-setup install an operating system. There is something else going on. I urge you to start from scratch with a new VM. Make sure you follow https://docs.securityonion.net/en/2.4/network-installation.html#installing-via-the-network not https://docs.securityonion.net/en/2.4/appendix.html

[NeoLife-iT]

This is now working with latest version. Thanks for this I am much appreciated.