https://github.com/Security-Onion-Solutions/securityonion/issues/1764

salt/common/tools/sbin/so-status

@@ -24,7 +24,7 @@ fi
 
 # Constants
 SYSTEM_START_TIME=$(date -d "$(</proc/uptime awk '{print $1}') seconds ago" +%s)
-LAST_HIGHSTATE_END=$(date -r /opt/so/log/salt/lasthighstate +%s) # file populated by salt.lasthighstate state at end of successful highstate run
+LAST_HIGHSTATE_END=$([ -f "/opt/so/log/salt/lasthighstate" ] && date -r /opt/so/log/salt/lasthighstate +%s || echo 0) # file populated by salt.lasthighstate state at end of successful highstate run
 HIGHSTATE_RUNNING=$(salt-call --local saltutil.running --out=json | jq -r '.local[].fun' | grep -q 'state.highstate' && echo $?)
 ERROR_STRING="ERROR"
 SUCCESS_STRING="OK"

salt/salt/lasthighstate.sls

@@ -0,0 +1,4 @@
+lasthighstate:
+  file.touch:
+    - name: /opt/so/log/salt/lasthighstate
+    - order: last

salt/top.sls

@@ -35,6 +35,7 @@ base:
     - common
     - patch.os.schedule
     - motd
+    - salt.lasthighstate
   
   '*_helix and G@saltversion:{{saltversion}}':
     - match: compound