From 1a75ebdca312369e7d75ba5947f7930d5c798249 Mon Sep 17 00:00:00 2001
From: m0duspwnens <josh.patterson@securityonionsolutions.com>
Date: Thu, 5 Nov 2020 17:51:51 -0500
Subject: [PATCH] 
 https://github.com/Security-Onion-Solutions/securityonion/issues/1764

---
 salt/common/tools/sbin/so-status | 2 +-
 salt/salt/lasthighstate.sls      | 4 ++++
 salt/top.sls                     | 1 +
 3 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/salt/common/tools/sbin/so-status b/salt/common/tools/sbin/so-status
index 714e71bc9..05f32d7ce 100755
--- a/salt/common/tools/sbin/so-status
+++ b/salt/common/tools/sbin/so-status
@@ -24,7 +24,7 @@ fi
 
 # Constants
 SYSTEM_START_TIME=$(date -d "$(</proc/uptime awk '{print $1}') seconds ago" +%s)
-LAST_HIGHSTATE_END=$(date -r /opt/so/log/salt/lasthighstate +%s) # file populated by salt.lasthighstate state at end of successful highstate run
+LAST_HIGHSTATE_END=$([ -f "/opt/so/log/salt/lasthighstate" ] && date -r /opt/so/log/salt/lasthighstate +%s || echo 0) # file populated by salt.lasthighstate state at end of successful highstate run
 HIGHSTATE_RUNNING=$(salt-call --local saltutil.running --out=json | jq -r '.local[].fun' | grep -q 'state.highstate' && echo $?)
 ERROR_STRING="ERROR"
 SUCCESS_STRING="OK"
diff --git a/salt/salt/lasthighstate.sls b/salt/salt/lasthighstate.sls
index e69de29bb..606bd1082 100644
--- a/salt/salt/lasthighstate.sls
+++ b/salt/salt/lasthighstate.sls
@@ -0,0 +1,4 @@
+lasthighstate:
+  file.touch:
+    - name: /opt/so/log/salt/lasthighstate
+    - order: last
\ No newline at end of file
diff --git a/salt/top.sls b/salt/top.sls
index 2b55c4724..36fd171e1 100644
--- a/salt/top.sls
+++ b/salt/top.sls
@@ -35,6 +35,7 @@ base:
     - common
     - patch.os.schedule
     - motd
+    - salt.lasthighstate
   
   '*_helix and G@saltversion:{{saltversion}}':
     - match: compound