From 1a2245a1ed188be34b2ffbcb6304567c9c5abdee Mon Sep 17 00:00:00 2001
From: Mike Reeves <mike.reeves@securityonionsolutions.com>
Date: Mon, 29 Jan 2024 13:44:53 -0500
Subject: [PATCH] Add so-minion modifications

---
 salt/manager/tools/sbin/so-minion | 25 +++++++++++++++++++++++++
 salt/suricata/soc_suricata.yaml   |  2 +-
 2 files changed, 26 insertions(+), 1 deletion(-)

diff --git a/salt/manager/tools/sbin/so-minion b/salt/manager/tools/sbin/so-minion
index d5225cc82..12349b680 100755
--- a/salt/manager/tools/sbin/so-minion
+++ b/salt/manager/tools/sbin/so-minion
@@ -79,6 +79,30 @@ function getinstallinfo() {
 	source <(echo $INSTALLVARS)
 }
 
+function pcapspace() {
+
+	local NSMSIZE=$(salt \* disk.usage --out=json | jq -r '.[]."/nsm"."1K-blocks" ')
+	local ROOTSIZE=$(salt \* disk.usage --out=json | jq -r '.[]."/"."1K-blocks" ')
+
+	if [[ "$NSMSIZE" == "null" ]]; then
+		# Looks like there is no dedicated nsm partition. Using root
+		local SPACESIZE=$ROOTSIZE
+	else
+		local SPACESIZE=$NSMSIZE
+	fi
+
+	local s=$(( $SPACESIZE / 1000000 ))
+	local s1=$(( $s / 2 ))
+	local s2=$(( $s1 / $lb_procs ))
+
+	printf '%s\n'\
+		"suricata:"\
+		"  config:"\
+		"    output:"\
+		"      pcap-log: $s" >> $PILLARFILE
+	
+}
+
 function testMinion() {
 	# Always run on the host, since this is going to be the manager of a distributed grid, or an eval/standalone.
 	# Distributed managers must run this in order for the sensor nodes to have access to the so-tcpreplay image.
@@ -252,6 +276,7 @@ function add_sensor_to_minion() {
 	if [[ $is_pcaplimit ]]; then
 		echo "  config:" >> $PILLARFILE
 		echo "    diskfreepercentage: 60" >> $PILLARFILE
+		pcapspace
 	fi
 	echo "  " >> $PILLARFILE
 }
diff --git a/salt/suricata/soc_suricata.yaml b/salt/suricata/soc_suricata.yaml
index 58a2273b9..5dddd7442 100644
--- a/salt/suricata/soc_suricata.yaml
+++ b/salt/suricata/soc_suricata.yaml
@@ -181,7 +181,7 @@ suricata:
           description: File size limit per thread. To determine max PCAP size multiple threads x max-files x limit.
           helpLink: suricata.html
         mode: 
-          description: Suricata PCAP mode. Currenlty only multi is supported.
+          description: Suricata PCAP mode. Currently only multi is supported.
           advanced: True
           readonly: True
           helpLink: suricata.html